# Image-Based Malware Detection Using \(\alpha\)-Cuts and Binary Visualisation
## 5 Discussion
This differs from the majority of other studies that focus on family classification, which often perform classification with the help of image feature extraction. One such example can be found in the work of [100] who successfully predicted family class from the Malimg dataset. Additionally, as concluded in the survey of [101], malware classification that relies on feature extraction as per class can lead to redundant information and negatively affect accuracy rates while demanding constant updates. From the above analysis, it is evident that we concentrated our efforts on including as many factors as we could to simulate the restrictions of a realistic IDS. In this regard, we measured the performance of several hyperparameterised ResNet50 models that were trained on image datasets. The datasets, which were created from files of malicious and benign code, differed in size, colouring method, and \(\alpha\)-cut processing. The colouring methods included the method of [18], the method of [17], and our proposed colour classes, while the datasets of the last two methods were also processed with \(\alpha\)-cuts. For each colour method and processing (or lack thereof) combination, we tested four different dataset sizes. As we observed from the results, the performance metrics were positively affected as the dataset size increased. However, the colouring approach of [18] displayed limited improvement, and none of the experiments were able to reach an accuracy of 90% (Table 4). This proves [18]'s inefficiency to construct meaningful patterns of colourful pixels that could reveal the presence of malicious code and can be attributed to its limited number of colour classes. In contrast, our proposed approach and the approach of [17] displayed consistently improving scores, exhibiting larger gaps between the scores of the smallest and the largest dataset sizes (Tables 5-10). Notably, the difference in results between the best-performing models of our proposed colouring scheme and the work of [17] were not numerically significant. Indeed, both methods acquired comparative accuracies and f-scores of around 93-94% and 92-94%, respectively. It is worth mentioning that the difference between these two approaches (when not applying any \(\alpha\)-cutting, see Tables 5 and 8) lies in the number of colour classes (we proposed a more detailed clustering of the ASCII table), while both have incorporated an FIS that adjusts the pixel colour tone according to its surroundings. Nevertheless, applying \(\alpha\)-cuts had different effects on them visually, as the initial RGB values per pixel differ significantly. Another interesting comparison regarding these two methods would be that for each approach, we observed a slight decline between the experiment that used the unprocessed dataset and the experiments that used \(\alpha\)-cut processed datasets (Tables 5-10). More precisely, the best-performing model of the unprocessed dataset of [17]'s approach (Table 5) surpassed the best-performing model of the reduced datasets (Tables 6 and 7). Similarly, the best performing model of the unprocessed dataset of our approach (Table 8) surpassed the best-performing model of the reduced datasets (Tables 9 and 10). From these findings alone, it would seem that processing an image with an \(\alpha\)-cut removes valuable information and impedes the model from making successful predictions. However, when examining the learning curves of all experiments for these two methods, it was evident that the models would not be able to generalise well, despite high scores or not. More precisely, almost all graphs exhibited high volatility, indicating a lack of correct predictability for new instances.