## 3 Methodology
### Feature Extraction
#### 3.4.1 Texture Feature (SFTA)
The ReLu and FC (fully connected) layers are defined as:

\[R_{i}^{l}=\max\bigl{(}h,h_{i}^{l-1}\bigr{)}, \tag{12}\]

\[FC_{i}^{l}=f\bigl{(}z_{i}^{l}\bigr{)}\,with\,\,z_{i}^{l}=\sum_{q=1}^{m_{1}} \sum_{r=1}^{m_{2}}\sum_{s=1}^{(l-1)}\sum_{s=1}^{m_{3}}\bigl{(}-1\bigr{)}\,x_{ i,j,r}^{l}\bigl{(}FC_{i}^{l-1}\bigr{)}_{r,s} \tag{13}\]

Figure 5: Framework of deep convolutional neural network (CNN) for feature extraction from malware images. Here, \(R_{i}^{l}\) represents the ReLu layer and \(FC_{i}^{l}\) represents the FC layer. The FC layers follow the convolution and pooling layers. The FC layer is like a convolution layer, and the greater part of the analysts perform activation on the FC layer for deep features extraction. #### 3.4.3 DCNN Feature Extraction and Fusion

Here we use two distinctive pre-trained models (AlexNet, Inception-V3) for feature extraction. These models have different structures, but they have been trained with the same dataset of malware. AlexNet [47] contains five progressive convolutional layers, Conv1 - Conv5, succeeded by three max-pooling layers, and three FC layers, FC7 with a last softmax classifier. The AlexNet CNN has been trained on 1.2 million images of 1000 classes, with around 60 million network parameters. The network only accepts RGB images with a dimension size of \(224\times 224\times 3\). The Inception-V3 [48] model is composed of well-structured convolution modules that can both produce preferential features and decrease the quantity of the parameters. Every Inception module is made of a few convolutional layers and pooling layers in equal numbers. Convolutional layers, for example, \(3\times 3\), \(1\times 3\), \(3\times 1\), and \(1\times 1\) layers, are utilized in the Inception modules to diminish the quantity of parameters. The purpose of DCNN feature extraction from two network models is to improve the classifier accuracy. Since both models have characteristics and qualities of different extract features. Therefore, three kinds of features are extracted and used: AlexNet features, Inception-V3 features and texture (SFTA) features. We extract \(M\times 87\) features from SFTA and deep features by performing an activation function on the FC7 layer and applying max pooling to expel the noise. The FC7 layer extracted \(N\times 4096\) features, and \(O\times 2048\) features are extracted through the average pooling layer, where \(M\), \(N\), and \(O\) represent the number of images passed to the model. To get efficient results, we perform serial based fusion to fuse the deep features and texture feature SFTA. Three feature vectors are defined as follows. Let \(1\times M\) represent the SFTA feature vector, \(1\times N\) represent the AlexNet feature vector, and \(1\times O\) represent the Inception-V3 feature vector, then, Equations (14)-(16) are formulated for the features vector:

\[f_{s\times m}=\{s_{1\times 1},s_{1\times 2},s_{1\times 3},s_{1\times 4},....,s_{1\times m}\}, \tag{14}\]

\[f_{s\times n}=\{a_{1\times 1},a_{1\times 2},a_{1\times 3},a_{1\times 4},....,a_{1 \times n}\}, \tag{15}\]

\[M_{i}^{N}=b_{i}^{N}+\sum_{j=1}^{m_{1}}\sum_{i,j}^{N}\psi_{i,j}^{N}\times h_{j}^ {N-1} \tag{8}\]0

Then, the resulting feature vectors from SFTA, AlexNet and Inception-v3 are concatenated. These feature vectors are shown below:

\[M_{i}^{N}=b_{i}^{N}+\sum_{j=1}^{m_{1}}\sum_{i,j}^{N}\psi_{i,j}^{N}\times h_{j}^ {N-1} \tag{8}\]1

\[\sum(f_{s_{r}}f_{a_{r}}f_{l_{r}})=\left( \begin{array}{c}s_{1\times 1},s_{1 \times 2},s_{1\times 3},s_{1\times 4},....,s_{1\times m},\\ a_{1\times 1},a_{1\times 2},a_{1\times 3},a_{1\times 4},....,a_{1\times n},\\ i_{1\times 1},i_{1\times 2},i_{1\times 3},i_{1\times 4},....,i_{1\times n} \end{array} \right), \tag{18}\]

\[f_{Resu_{1\times q}}=\left\{p_{1\times 1},p_{1\times 2},p_{1\times 3},p_{1\times 4 },....,p_{1\times q}\right\}, \tag{19}\]

where \(f_{Resu_{1\times q}}\) is the resultant feature vector, and \(1\times q\) represents the dimension \(q=(m,n,o)\).