# Zero-Day Threat Mitigation via Deep Learning in Cloud Environments
## 4 Methodology
### Dataset and Preprocessing  
This study utilizes the MaLeX dataset, a widely recognized repository comprising over one million executable files. This dataset was selected for its extensive volume and diversity, enabling a rigorous evaluation of deep learning models under realistic and challenging scenarios of malware detection in cloud environments. Each executable file was transformed into a visual representation through the byteplot technique, producing \(256\times 256\) pixel images. The fixed image size of \(256\times 256\) pixels was chosen following guidelines established by previous studies on malware visualization and classification [35] and is consistent with standard resolutions employed in vision transformer (ViT) architectures [36]. This resolution strikes a balance by preserving relevant structural details of the binary file while avoiding the prohibitive computational cost typically associated with the global attention mechanism used in transformer-based models. This transformation allows the application of computer vision models, such as the proposed MVT, which leverages deep attention mechanisms to process binary files. The dataset was structured into two primary classes:  
* Class 0 (Benign): comprising legitimate files representing applications and programs with no malicious behavior. * Class 1 (Malicious): containing various malware samples, including multiple families and threat types. One of the main challenges identified in the MaLeX dataset is the significant class imbalance, with a considerably higher number of malware samples compared with benign files, which introduces a bias in the model, causing it to overfit the majority class and reducing its ability to accurately detect benign files, thereby increasing the risk of false  
Figure 3: Experimental methodology: Docker 23.0.3 environment setup and training process. The figure illustrates the pipeline for data preprocessing, model training, and validation within a containerized cloud environment. positives or negatives. To address the imbalance between benign and malicious classes, the Synthetic Minority Oversampling Technique (SMOTE 0.13.0) [25] was applied. This method enhances the representation of the minority class by generating synthetic instances through interpolation, reducing the risk of overfitting compared with simple duplication. However, SMOTE does not consider the structural and distributional complexity inherent to byteplot images generated from binary files, which may limit its effectiveness in capturing representative variations of the minority class. Although SMOTE was employed to address class imbalance, it does not fully capture the structural characteristics of byteplot images. Therefore, comparisons with more advanced data augmentation techniques are necessary to better illustrate their impact on model robustness and generalization. Techniques such as ImageMix, GAN-based synthesis, or domain-specific transformations could provide more representative synthetic samples for the minority class. Moreover, preprocessing and model training were conducted within a Dockerized environment, simulating a controlled and replicable cloud computing scenario. This environment included specific containers for the following:  
* Preprocessing: conversion of executable files into byteplot images. * Training: execution of the MVT model. * Validation: evaluation of the model using unseen data. The dataset was divided into training, validation, and testing sets, ensuring a robust evaluation and avoiding overfitting biases. Evaluation metrics included accuracy, recall, F1-Score, and confusion matrix, enabling a comprehensive analysis of the model's performance in classifying both benign and malicious files. This methodological approach ensures a rigorous and controlled evaluation, positioning MaLeX as an appropriate experimental environment for validating zero-day threat detection models in cloud computing settings.