## 2 Literature Survey  
Many malware classification and identification research works have been investigated based on different analysis approaches such as static-based, dynamic-based, and machine learning-based [13; 14; 15; 16]. This section provides a comprehensive survey of several malware classification methods. Static-based analysis deploys functional call-graph [17], features of portable executable (PE) malware files [18], function length frequencies [19], and opcode sequences [20]. [PERSON] et al. [21; 22; 23] implemented a static analysis to extract several static features from Android malware binary files such as permissions and API calls. Subsequently, they performed machine learning techniques to detect malware applications [24]. The authors of [25] developed a static analysis with Tensorflow (SAT) malware detection system. The proposed system performs a static analysis by employing a signature-based method on both known and new/modified malware. However, static-based analysis is not sufficient in the case of code obfuscation and zero-day malware [5]. In the dynamic-based analysis, the behavioral characteristics of malware are obtained, such as API calls [26], network activities [27], and log files [28]. In [27], [PERSON] et al. developed an automated malware and labeling scheme (AMAL). In the proposed system, several behavior-based features were extracted during the dynamic analysis, such as network activities, file systems, and registers. The authors of [28] integrated memory forensics techniques with a dynamic analysis approach. Initially, malicious artifacts were extracted from the memory. Subsequently, the Cuckoo Sandbox was deployed to monitor the malware behavior during its execution. Finally, the malicious artifacts and the behavioral report were combined to create the features dataset for further classification. However, malicious software may alter its behavior during its execution in a virtual environment; thus, the dynamic-based analysis might fail to capture the actual behavior of the malicious software. Recently, extensive research on malware classification has been made by deploying the vision-based approach [6; 7; 8; 29; 30; 31]. Some authors developed CNN solutions from scratch in which they did not use any pre-trained models [7; 9; 29; 30]. In [7], the authors developed a visualized malware classification system based on Artificial Neural Network (ANN). The proposed classification system used the extracted features of the Malimg database to train ANN. Subsequently, the trained model is further employed in classifying different samples of the Malimg database. The accuracy of applying one hidden layer was 96%. However, implementing two hidden layers achieved an accuracy of 99.135%. [PERSON] et al. have also visualized malware as gray-scale images to develop a file agnostic deep learning scheme based on CNN [29]. The proposed scheme extract patterns to classify malicious software allowing the malicious software to be classified in a real-time environment. Besides patterns, different features could be deployed in the malware visualization process. In [30], they have included the local features in visualizing the malware application by using the FastText model. Consequently, each malware family has a unique generated local malware image since the proposed system mainly includes the local features of each malicious software. Furthermore, the authors of [32] proved that combining deep CNN with an entropy graph contributes to enhancing the malware pattern classification process. In [33], the authors have investigated the classification on a different color scale in which they converted the malware APK files into colored images instead of gray-scale images. However, they have compared applying the classification between gray-scale and colored images and proved that applying the classification on colored images outperformed the gray-scale classification. [PERSON] et al.