# Malware Variants Detection Model Based on MFF-HDBA
###### Abstract  
A massive proliferation of malware variants has posed serious and evolving threats to cybersecurity. Developing intelligent methods to cope with the situation is highly necessary due to the inefficiency of traditional methods. In this paper, a highly efficient, intelligent vision-based malware variants detection method was proposed. Firstly, a bilinear interpolation algorithm was utilized for malware image normalization, and data augmentation was used to resolve the issue of imbalanced malware data sets. Moreover, the paper improved the convolutional neural network (CNN) model by combining multi-scale feature fusion (MFF) and channel attention mechanism for more discriminative and robust feature extraction. Finally, we proposed a hyperparameter optimization algorithm based on the bat algorithm, referred to as HDBA, in order to overcome the disadvantage of the traditional hyperparameter optimization method based on manual adjustment. Experimental results indicated that our model can effectively and efficiently identify malware variants from real and daily networks, with better performance than state-of-the-art solutions. m 202212959314 September 202212 September 2022222222222222222222222222222222222222222222222222222222  
In order to solve the dilemma faced by traditional detection methods, malware vision-based analysis technique was born [11]. Vision-based malware analysis has been proven to be effective and efficient in malware variant detection, and is 4000 times faster compared to dynamic detection techniques [12]. The method first maps malicious codes to grayscale images, and extracts the texture features of malicious code images on the basis of similarities to image texture features in the same malware family, along with differences in image texture features with different malware families. Then, the detected malware samples are classified on the basis of those features. Vision-based malware analysis does not depend on expert knowledge and static decompilation. Furthermore, even if the malware authors reuse the same malware segment in order to generate new malware variants, this is easily observed when we visualize the malware binary files. With the revolution of machine learning and deep learning techniques, computer vision is rapidly evolving, which enhances the development of malware detection based on visualization [13; 14; 15]. In 2011, [PERSON] et al. [16] first proposed a malware detection method based on visualization. The researchers mapped malicious binary portable executable (PE) files to grayscale images, and utilized the GIST descriptor for feature extraction; meanwhile, a K-nearest neighbor (KNN) classifier was trained for malware variants classification. The researchers achieved a high classification accuracy of 97.18% on their own data set. [PERSON] et al. [17] designed a simple convolutional neural network (CNN) structure for recognizing malware samples, which is a sequential structure consisting of three convolutional layers and two fully connected layers. Experimental results showed that their method achieved good performance in malware classification. However, numerous malware variants are constantly generated and updated via powerful malware development technologies, imposing increasing challenges to the feature extraction capabilities of malware detection approaches. Moreover, a common phenomenon on exiting malware data sets is that the samples in different categories are unbalanced, which may reduce the classification accuracy of models that are based on deep learning technology. Furthermore, it is essential for deep learning to optimize hyperparameters. However, the hyperparameter settings in recent related studies relied on human experience and lacked a theoretical basis and interpretability; consequently, the model became easily trapped in local optima.