# A Neural Network Approach to a Grayscale Image-Based Multi-File Type Malware Detection System
## 3 Methodology
### Feature Extraction Using Grayscale-Based Image Transforms  
Expanding upon our prior research efforts documented in [53; 54], it is evident that the utilization of image-based features bestows advantages in the detection and categorization of malware within image and PE file formats. Hence, this study extends the previous approach by incorporating image transforms to develop a comprehensive classifier that is capable of detecting malicious files across different file types, including PDFs, Microsoft Office documents, and PE files.  
Feature extraction was conducted using a common approach found in the literature that converts the PE file's features into a grayscale image. This involved converting raw binary codes into eight-bit unassigned vectors and reshaping them into a 2D array. The resulting grayscale image was then reshaped and resized using bicubic interpolation to match the input size requirements of the pre-trained models. Additionally, we observed that the bit conversion approach is compatible with various file types, allowing the creation of a uniform processing pipeline for different formats. Figure 3 illustrates the adopted approach for converting files into grayscale images. Similarly, the mathematical representation of the steps is also outlined below.  
**Step 1: Binary Data Representation**:  
The binary data from the first file are represented as a 2D binary array, denoted as \(B\), with dimensions \(M\times N\), where \(B(i,j)\) corresponds to the binary value at row \(i\) and column \(j\).  
**Step 2: Conversion to Numerical Array**:  
A mapping function \(f(B(i,j))\) is applied to convert the binary array \(B\) into a numerical array \(A\) with the same dimensions (\(M\times N\)). This mapping may include translating 0 to 255, following the grayscale encoding scheme. The process can be mathematically expressed as:  
\[A(i,j)=f(B(i,j)),\quad\text{for }i\in[1,M]\text{ and }j\in[1,N].\]  
**Step 3: Grayscale Image Generation**:  
The numerical array \(A\) is used to generate grayscale images, denoted as \(G\), with identical dimensions (\(M\times N\)). Each numerical value in \(A\) is directly translated into a pixel intensity value for the corresponding location in \(G\). The mapping is typically such that  
\begin{table}
\begin{tabular}{c l l l l} \hline \hline
**Citation** & **Dataset** & **File Types** & \
\begin{tabular}{c} **No. of Benign** \\ **Samples** \\ \end{tabular} &
\begin{tabular}{c} **No. of Malicious** \\ **Samples** \\ \end{tabular} \\ \hline
[55] & Zenodo &
\begin{tabular}{c} Microsoft Office \\ documents of \\ different formats \\ \end{tabular} & 2735 & 15,105 \\ \hline
[56] & jonaslepion & PDF & 9006 & 10,980 \\ \hline
[57] & Clean DOC files & DOC & 100 & 0 \\ \hline
[57] & Clean DOC files & DOC & 1300 & 0 \\ \hline
[57] & Clean XLS files & XLS & 300 & 0 \\ \hline
[57] & Clean XLS files & XLS & 100 & 0 \\ \hline
[57] & Clean PDF \& XLS & PDF & 500 & 0 \\ \hline
[58] & Dike dataset &
\begin{tabular}{c} doc, docx, docm, \\ xls, xlsx, xlsm, ppt, \\ pptx, and pptm \\ \end{tabular} & 100 & 1871 \\ \hline
[58] & [PERSON] dataset &
\begin{tabular}{c} exe \\ \end{tabular} & 982 & 8970 \\ \hline
[9] & [PERSON] dataset &
\begin{tabular}{c} Grayscale image \\ representation of \\ malicious exe files \\ \end{tabular} & 0 & 12,109 \\ \hline \hline \end{tabular}
\end{table}
Table 2: Summary of Datasets.  
pixel intensities range from 0 (representing black) to 255 (representing white) and can be expressed as  
\[G(i,j)=A(i,j),\quad\text{for }i\in[1,M]\text{ and }j\in[1,N].\]  
We used an open-source Python code for the grayscale image generation process [59]. Grayscale image samples are shown in Figures 4 and 5, displaying benign and malicious samples of Microsoft Word and PDF files, respectively.