# A New Framework for Visual Classification of Multi-Channel Malware Based on Transfer Learning
## 2 Related Work
### Methods Based on Visualization Techniques' Features  
The visualization of malware can observe its texture characteristics more intuitively and can reduce the impact of obfuscation technology. Therefore, more and more related research based on visualization technology has emerged. In recent years, the combination of machine learning and visualization technology has gradually begun to rise. [PERSON] et al. (2019) proposed for the first time applying visual methods to detect malware samples and use machine learning methods for classification. First, the malware binary sequence is read. Then, it is cut into 8-bit subsequences and converted to 0-255 pixel intervals through a decimal system. Finally, according to the file size, the image width is fixed, and the gray image is generated. The core of the malicious binary file is represented in the image features. [PERSON] et al. (2019) proposed a visual detection method for malware based on machine learning. First, the malware is transformed into a feature image. Then, the size is unified by scaling technology, and the AE and AT technologies are combined. Finally, the machine learning method is used to detect the image samples.  
In order to overcome the deficiencies of machine learning, such as being vulnerable to feature engineering, it is suitable to train small sample datasets. At present, visualization technology based on deep learning has become popular. [PERSON] et al. (2019) used the SimHash technology to convert malware binary files into grayscale images and then identified their families through convolutional neural networks. The experimental results showed that the accuracy rate on the Microsoft malware dataset was as high as 99.26%, and a new sample can be recognized on average in 1.41 s. [PERSON] et al. (2019) proposed a malware classification method based on visualization and feature fusion. By extracting bytes and operation codes from the Microsoft dataset, they combined global structure information with local semantic information and used convolutional neural networks to classify and detect the generated images. [PERSON] et al. [40] extracted three different features from malware binary files to generate images (grayscale images, Markov images, and entropy images) and fused them into three-channel GEM images. Experiments were conducted using two different small sample learning architectures, the convolutional Siamese neural network (CSNN) and shallow few-shot (Shallow-FS). The experimental results showed that the CSNN is suitable for scarce data; otherwise, Shallow-FS is better.  
In order to speed up the model training and improve the performance of classification detection, researchers have introduced the method of transfer learning. [PERSON] et al. [41] transformed malware binary files into color images and used data enhancement methods to process unbalanced datasets in the fine-tuning process. The parameters of the pre-trained model on the ImageNet dataset were applied to the ResNet network model to classify and detect the generated images. [PERSON] et al. [42] proposed an EfficientNetB1 network based on transfer learning to classify byte-level images of malware. Three different methods for image representation of malware were studied, and the optimal image representation of malware with a fixed image width was studied in more detail. Although good results were achieved, the different types of grayscale images generated were not fused.