## 3 Methodology
### Feature Extraction
#### 3.4.1 Texture Feature (SFTA)
The results of the Friedman test regarding accuracy (see Figures 11-14) \begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Classifier** & **Recall (\%)** & **Accuracy (\%)** & **AUC (\%)** & **ER (\%)** \\ \hline Linear SVM & 98.0 & 98.5 & **100.0** & 1.5 \\ Fine Decision Tree & 77.0 & 82.8 & 97.0 & 17.2 \\ Weighted KNN & 95.0 & 96.3 & 99.0 & 4.3 \\ Medium KNN & 93.0 & 94.7 & 99.0 & 6.7 \\ Fine KNN & 97.0 & 97.7 & 98.0 & 3.7 \\ Cosine KNN & 96.0 & 96.9 & 99 & 4.9 \\ Boosted Decision Tree & 97.0 & 72.8 & 99.0 & 27.2 \\ Quadratic SVM & 95.0 & 99.1 & **100.0** & **1.0** \\ Linear Discriminate & 97.0 & 97.6 & 99.0 & 3.6 \\ Cosine Decision Tree & 21.0 & 33.5 & 37.0 & 66.5 \\ Medium Decision Tree & 48.0 & 66.8 & 84.0 & 33.2 \\ Cubic SVM & **99.0** & **99.3** & **100.0** & 1.3 \\ \hline \hline \end{tabular}
\end{table} 
Table 6: Balanced (augmented) data with feature fusion of SFTA and a deep convolutional neural network (DCNN). Best values are shown in bold. Figure 10: Classification results (recall, accuracy, AUC and ER) using a fusion of SFTA and pre-trained network features on the balanced (augmented) dataset. The best classification results (based on accuracy) for all experiments are summarized in Figure 16. Note that image augmentation allowed a statistically significant improvement of results to be achieved for the SFTA features (by 4.1%, \(p<0.05\), using non-parametric Wilcoxon rank-sum test). However, for the fused feature set, the improvement was not statistically significant. On the other hand, using feature fusion on the original (imbalanced) dataset also allowed a statistically significant improvement to be achieved (by 3.5%, \(p<0.05\)). Figure 16: Comparison of best accuracy for malware classification for different feature sets (SFTA features vs a fusion of SFTA and neural network features) and imbalanced/balanced datasets. Figure 15: Confusion matrix of the best classifier (cubic SVM with a fusion of SFTA and neural network features). ### Comparison of the Results of the Proposed Technique with Other Existing Methods

The results on the Malimg dataset are compared with the results of other authors using the same dataset in Table 7. Note that our method allowed the best results to be achieved on this dataset. **Complexity:** As shown in Figure 1, our proposed method consists of five key steps such as data augmentation, features extraction, fusion, selection, and classification. From these, the fusion and selection steps are much important, and the efficiency of our system depends on these. We compute the complexity in the form of Big-O (\(O\)) notation for each step. For data augmentation, features extraction, and classification, the complexity is \(O(1)\), while for features fusion and selection, the complexity is \(O(n)+3\) and \(O(n)+k\), where \(k\) denotes the number of selected parameters. Hence, our method is working under one major loop, so the overall complexity is \(O(n)=C\). ## 5 Conclusions

In this paper, we have demonstrated a hybrid method which uses image augmentation and a fusion of segmentation-based fractal texture analysis (SFTA) and pre-trained deep neural network (AlexNet and Inception-v3) features to classify malware images into various classes using different state-of-the-art classifiers. In the first step, the grayscale images are generated using the bytecodes from the malicious programs. Then, in the second step, image augmentation is performed to balance the malware classes and resize the images to \(227\times 227\times 3\). In the last phase, the pre-trained network features and SFTA best features are selected and fused. Then, the selected features are forwarded to several versions of KNN, SVM, DT, and LD classifiers for malware image identification. The key advantage of the proposed method is the ability to achieve a high level of classification accuracy when compared to the existing methods. When faced with imbalanced data sets there is no one stopping solution to improve the accuracy of the prediction model.