# Binary and Multi-Class Malware Threads Classification
## 4 The Proposed Methods  
Three main processes make up the suggested technique for malware analysis: (a) malware conversion; (b) feature extraction; and (c) classification. For proper malware analysis, we first transform the RGB malware images into grayscale malware images. In the feature extraction step, the SFTA and Gabor features are extracted from grayscale images. Lastly, the classification is carried out by GDA and NB. Figure 4 depicts the proposed method's flowchart. Additionally, the Algorithm 1 was developed. In the subsections below, each step's full details are presented. Step 1: **Malware Conversion**  
The PE binary files (malware or Non-Malware) are often visualized and provided as input for malware analysis (detection and classification task). In the majority of malware detection and classification task, each PE binary file is converted into a 2D array and visualized as a grayscale image. While there is a significant variance between distinct families, the image textures of the same families are very similar [10]. However, the PE binary files in MaleVis dataset are visualized as RGB byte images that belong to 26 malware classes, including 25 malware and 1 Non-Malware. Therefore, it is necessary to convert these RGB images into grayscale images. Figure 5 demonstrates the conversion of RGB malware images into grayscale malware images. Figure 3: A two-dimensional Gabor filter with eight orientations and five scales [31]. ```
Input: RGB Malware Image. Output: Non-Malware/Malware Image. Begin For 1: Use the \"Imread ()\" function to read each image; 2: Convert the RGB image to the gray-scale image using Matlab function such as \"rgb2 gray ()\"; 3: Then, the SFTA features [_Sfhaf1_, _Sfhaf2_, _Sfhaf3_, _Sfhaf4_,... _Sfhaf21_] are extracted to obtain \(1\times 21\)-dimension feature vector; 4: Extract the Gabor features vector: A. Apply 2D Gabor filters to each image that has been converted. B. Extract the mean squared energy and mean amplitude as the Gabor features [Gaborf1, Gabor2, Gabor3, Gabor4... Gaborf12] to obtain a 12-dimension feature vector. 5: Training: A. Employ the above feature vectors to train the GDA classifier; B. Employ the above feature vectors to train the NB classifier; 6: Testing: A. The trained GDA model are tested to identify whether the image is non-Malware or Malware; B. The trained NB model are tested to identify whether the image is non-Malware or Malware. End for End
```  
**Algorithm 1**Proposed MC_based GDA and NB Classifier. Figure 4: Proposed method Flowchart. Figure 5: The Conversion Process Diagram. Following malware visualization, features are extracted for malware analysis. Both the machine learning (ML) and computer security (CS) communities have looked into feature extraction for malware analysis. As can be observed, malware classification (MC) frequently employs the same set of features as malware detection (MD). There are typically two ways to extract image features: the first type includes extracting the global features from the entire image; in the second type, local feature points are extracted and then described using pertinent features. The image's primary global features are texture, color, shape, and space of the image. We came to the conclusion that textural features were much more suitable and adequate as the global characteristics of malware after studying the traits and contained data of malware images. SFTA and Gabor are two commonly used texture feature extraction methods. Due to its resilience and lower computational complexity compared to other methods, SFTA is the greatest fit for our purposes. Since Gabor is the best choice to reduce feature dimension when compared to the various texture methods, it was chosen to extract mean squared energy and mean amplitude features. Step 2.1: **SFTA Features Extraction**  
The malware may be easily recognized due to a texture-based feature that was generated from malware that could be seen. As shown in Algorithm 2, SFTA Texture features are extracted by hand-engineering methods.