# A New Framework for Visual Classification of Multi-Channel Malware Based on Transfer Learning
###### Abstract
Finally, deep learning methods are combined to improve malware detection accuracy. However, visualization techniques based on currently available deep neural networks still face many challenges. For example, the convolutional neural network model used is too simple, with insufficient generalization ability, and cannot effectively extract important information contained in malware. At the same time, the extracted malware features are single and only focus on one aspect of the malware features, which affects the accuracy of classification and detection. The generated image generally needs to be uniform in size, which easily causes information loss in the process of processing and contains obvious noise features. To solve the above problems, this paper proposes a malicious software detection and classification method based on depth learning of multi-channel RGB images. This method transforms malware into a three-channel image, combines the depth convolution neural network model with transfer learning, integrates bilinear interpolation, multi-channel feature extraction, data enhancement, and other technologies, and improves the efficiency and accuracy of classification detection based on effectively retaining malware sample information. The main contributions of this paper are summarized as follows:* A new method of malware visualization is proposed, which transforms the extracted malware binary file information into three different grayscale images and fuses them into three-channel RGB images. We can analyze malware from a multi-dimensional perspective and effectively retain relevant information in the malware binary file. * We propose a new framework for malware classification using convolutional neural networks. We combined the ResNet34 convolutional neural network model with the model trained on the ImageNet dataset for transfer learning and compared the performance with other ResNet network models. This method does not require reverse analysis and can achieve a good training effect in a short time, effectively improve the accuracy of malware classification, and enhance the model's generalization ability. * Compared with the sample images' interception or filling method, this paper used image interpolation algorithms to deal with the size of grayscale images and compared and analyzed the performance of different interpolation algorithms. Without loss of image information, it can effectively avoid the loss of feature information. * The RGB images generated were processed by using the contrast limited adaptive histogram equalization (CLAHE) data enhancement method, which can better deal with the problem of data imbalance. At the same time, it can effectively limit noise amplification, expand the local contrast, and display more details of the smooth areas. The rest of the study is organized as follows: Section 2 introduces the traditional malware detection methods and related research on using visualization techniques to classify malware. Section 3 introduces in detail the visual characteristics of multi-channel RGB images based on transfer learning and the new framework of the malware classification method based on the ResNet convolutional neural network. Section 4 gives the experimental results and makes a comparative analysis of the experimental data. Finally, Section 5 summarizes the study and provides some ideas and suggestions.