# Image-Based Malware Detection Using \(\alpha\)-Cuts and Binary Visualisation  
[PERSON]  
1 Lab of Mathematics and Informatics (ISCE), Faculty of Mathematics, Programming and General Courses, Department of Civil Engineering, School of Engineering, Democritus University of Thrace, Kimmera, 67100 Xanthi, Greece; [EMAIL_ADDRESS] (B.S. ); [EMAIL_ADDRESS] (B.P.) [PERSON]  
2 School of Computing, University of Portsmouth, Portsmouth PO1 ZUP, UK; [EMAIL_ADDRESS]  
[PERSON]  
3 Centre for Cybercrime and Economic Crime, University of Portsmouth, Portsmouth PO1 ZUP, UK 34 Correspondence: [EMAIL_ADDRESS]  
[PERSON]  
1 Lab of Mathematics and Informatics (ISCE), Faculty of Mathematics, Programming and General Courses, Department of Civil Engineering, School of Engineering, Democritus University of Thrace, Kimmera, 67100 Xanthi, Greece; [EMAIL_ADDRESS] (B.S. ); [EMAIL_ADDRESS] (B.P.) other case [4,5]. For the moment, GDPR, which came into force in 2018, does not impose specific technical directions for applications that stand between security and personal data processing. At the same time, it releases any data that is processed to a state of anonymity from complying with the policy [5]. In that respect, image conversion of personal data (such as network traffic) can act as a form of masking user credentials and facilitate the development of GDPR-compliant security tools. Image conversion of malware binaries is therefore a promising tool for the security community. Since the first attempts of visualising binaries [6,7] and the first image-based malware classification system [8], there has been a large volume of published studies experimenting with image generation or training classifiers. For example, some studies have been focused on texture analysis [8, 9, 10], or DL [2,3,11,12], all of which demonstrated positive results towards malware detection. However, there has been little or no effort towards the investigation of image segmentation; that is, methods that could enhance the extraction of classes within an image. Since we are dealing with synthetic images, the elements we wish to specify are pixelated patterns that could reveal the presence of malicious activity. Two popular heuristics in image segmentation are colour and contrast, according to which, image segmentation techniques are able to identify shape boundaries based on pixel values. Still, these methods would prove difficult to implement in binary images, where information presentation is decided on an arbitrary colouring scheme and a highly sensitive sequence mapping. As stated before, one of the goals of this study was to be able to work on byte-level data of files while preserving GDPR specifications. This would be violated, for example, when performing feature selection during static or dynamic analysis of malware files. For this reason, we chose a binary visualisation method that permits a level of anonymity to file contents while leveraging the advantages of optimal sequence mapping. The method has already been adopted by several research studies, including our own, showing good results in malware family classification [13, 14, 15], network traffic classification [16], and malware file detection [17]. Prior to this study, we had tested an image-based malware detection system where the visualisation colouring scheme was based on fuzzy sets. Continuing from that work, we now propose a novel method that enhances colour and pattern segmentation based on \(\alpha\)-cuts of the pixel colour values. The \(\alpha\)-cut is one of the most significant notions in fuzzy set theory for defuzzification, or the conversion of a fuzzy set to a crisp one. According to our method, we view the R, G, and B colour values of each pixel as respective fuzzy sets and perform an \(\alpha\)-cut across all pixels of the image. After the \(\alpha\)-cut, which acts essentially as a threshold, the new R, G, and B values for each pixel take either a value of 1 or 0 according to their initial value, producing new colour regions on the image.