A Novel Malware Classification Using CNN-SVM Deep Learning Method Based on Transfer Learning Architecture

With the frequent occurrence of global security incidents, the detection of malware has become a popular topic in the cyber security area. Deep learning techniques outperform conventional pattern-matching techniques in malware classification tasks. However, deep learning requires more time for model training. Therefore, we adopt transfer learning, where pretrained models are in a new model, which reduces the training time and generalization error. In this study, we propose a convolutional neural network (CNN)–support vector machine (SVM) deep learning method based on the transfer learning architecture for malware classification. VGG16, pretrained on ImageNet via transfer learning, is employed as the CNN model. We remove the fully connected layer from the VGG16 model to treat it as a feature extractor. Next, the Microsoft BIG 2015 dataset (10,868 malware samples of 9 families) is converted into grayscale images and input into the VGG16 model for feature extraction, thereby obtaining a new dataset. Finally, the new dataset is input into the SVM classifier for the classification task.