# Image-Based Malware Detection Using \(\alpha\)-Cuts and Binary Visualisation
## 5 Discussion  
The aim of the present research was to examine whether sparse representations of malware binary images carry sufficient information to become an integrated part of a DL-based IDS. As can be seen in the literature review, binary visualisation has exceeded the role of a malware analysis tool by evolving into an indispensable component of malware detection mechanisms, thanks to the widespread adoption of CNNs. At the same time, in an effort to ameliorate computational costs, recent innovations in NN models seek to experiment with the notion of sparsity; either internally, by pruning model components, e.g., relu, weight regularisation, etc. [96], or externally, e.g., by selecting an optimised storage format for sparse inputs [97], or by generally studying how input data dimensionality can influence prunability [98]. In fact, sparsity is expected to become an increasingly important issue in the future and even affect hardware choices [99]. To the best of our knowledge, no previous study (a) has used \(\alpha\)-cuts to create reduced forms of images or (b) has measured the efficacy of sparse representations in DL training. \begin{table}
\begin{tabular}{c c c c c} \hline \hline \multicolumn{5}{c}{**Clouring Method: Our Method, Reduced for \(\alpha=0.6\)**} \\ \hline
**Dataset Size** & **Accuracy (\%)** & **Precision (\%)** & **Recall (\%)** & **F-Score (\%)** \\ \hline
1250 & 83.20 & 88.88 & 76.19 & 82.05 \\
2500 & 91.20 & 94.78 & 87.20 & 90.83 \\
5000 & 93.20 & 97.36 & 88.80 & 92.88 \\
10,000 & **93.60** & **94.48** & **92.60** & **93.53** \\ \hline \hline \end{tabular}
\end{table} 
Table 10: Performance metrics for our method, processed with \(\alpha=0.6\). Figure 8: The learning curves of mean training and validation accuracies (a) and mean training and validation losses (b) during training of the best ResNet50 model. The model was trained on 10,000 images of the proposed colouring scheme that had been processed with an \(\alpha\)-cut of 0.6. \begin{table}
\begin{tabular}{c c c c c} \hline \hline \multicolumn{5}{c}{**Clouring Method: Our Method, Reduced for \(\alpha=0.6\)**} \\ \hline
**Dataset Size** & **Accuracy (\%)** & **Precision (\%)** & **Recall (\%)** & **F-Score (\%)** \\ \hline
1250 & 87.20 & 89.83 & 84.12 & 86.88 \\
2500 & 89.20 & 95.37 & 82.39 & 88.41 \\
5000 & 93.40 & 96.56 & 90.00 & 93.16 \\
10,000 & 92.90 & 93.86 & 91.80 & 92.82 \\ \hline \hline \end{tabular}
\end{table} 
Table 9: Performance metrics for our method, processed with \(\alpha=0.3\). Consequently, this is the first time this approach is being proposed for image-based malware detection. This can be considered a significant step forward in detection mechanisms that seek to operate in a real-time fashion, such as network traffic analysis. Indeed, one aspect of our method that compromised the accuracy of the model was the fact that, depending on its size, a single binary file would translate into _multiple_ fixed-size images. However, this was compliant with the future goal of our work, which is to diverge from a host-based to a network-based IDS and focus on inside packet detection where unencrypted network flow will be represented as a continuous generation of images. At the same time, the disadvantage of generating multiple images per file imposed the need for careful ASCII table clustering to maximise pattern construction across the binary. Another restriction imposed by our objective to prepare the ground for a network-based IDS was the need to concentrate strictly on binary classification, or simply perform malware detection. In other words, we had to test our methods solely on the distinction between malicious and benign activity and have this classification serve as a prototype for network traffic. For this reason, it was found unnecessary to perform malware family classification, as well-established differentiations between family labels, which could lead to forcedly high accuracy scores and would not depict realistic capturing of unknown attacks in a network flow environment.