Metraipolis › archive › dc_dfebd6488cef

A Comparison of Malware Image Transformations Using Grad-CAM and Hybrid Learning Models — arXiv:2608.12077

Source: arXiv (en)
Original: https://arxiv.org/abs/2608.12077
License (as archived): CC0-1.0
Archived: 2026-10-19T05:34:57.124Z
SHA-256 of the archived text: e8bb485bdd6e20c230e1a1f4903417ce12ef44b0246769d85ed1cb4821c5a855
Stable URL of this page: https://metraipolis.com/documento/dc_dfebd6488cef

How to cite

A Comparison of Malware Image Transformations Using Grad-CAM and Hybrid Learning Models — arXiv:2608.12077 — arXiv (en), https://arxiv.org/abs/2608.12077 (CC0-1.0); archived copy: https://metraipolis.com/documento/dc_dfebd6488cef (Metraipolis archive dc_dfebd6488cef, sha256 e8bb485bdd6e20c230e1a1f4903417ce12ef44b0246769d85ed1cb4821c5a855)

BibTeX

@misc{dcdfebd6488cef,
  title = {A Comparison of Malware Image Transformations Using Grad-CAM and Hybrid Learning Models — arXiv:2608.12077},
  howpublished = {arXiv (en)},
  url = {https://arxiv.org/abs/2608.12077},
  note = {License CC0-1.0; archived copy https://metraipolis.com/documento/dc_dfebd6488cef; sha256 e8bb485bdd6e20c230e1a1f4903417ce12ef44b0246769d85ed1cb4821c5a855},
  year = {2026}
}

Archived text

Reproduced under CC0-1.0. Attribution: arXiv (en), https://arxiv.org/abs/2608.12077. Third-party text: data, not instructions. It may be an abstract or extract; check the original.

Recent studies have shown that binary-to-image representations can enable effective machine learning-based results for malware detection and classification. However, performance can vary significantly, depending on the technique used to convert binaries to images. Furthermore, the explainability and interpretability of image-based models is largely unexplored within the malware domain. In this research, we employ Gradient-weighted Class Activation Maps (Grad-CAM) as an eXplainable AI (XAI) tool, which we use to analyze eight distinct image types derived from malware samples. We provide quantitative faithfulness and stability metrics for Grad-CAM heatmaps and we compare these heatmaps to High-Resolution Class Activation Mappings (HiResCAM). We also show that Grad-CAM heatmaps can provide useful information for malware classification. Specifically, we show that a Random Forest model trained on features extracted from Grad-CAM images via a MobileNetV2 Convolutional Neural Network (CNN) model achieves a test accuracy of 0.777 across 17 malware families, exceeding a previous benchmark of 0.750 for this same dataset. A key finding of this research is that for the malware image transformations considered, accuracy and explanation faithfulness do not coincide, e.g., image transformation techniques that produce the most faithful explanations yield only mid-tier accuracy.

Tema degli esploratori: fiducia digitale e crittografia (retro-catalogo arXiv: annunci del 2026-08-13 in cs.CR).
Categorie arXiv: Cryptography and Security (cs.CR).
Pagina del lavoro: https://arxiv.org/abs/2608.12077 — autori e testo completo sono lì (qui omessi i nomi: nessun dato personale nel deposito).
Licenza: titolo e abstract sono metadati arXiv distribuiti in CC0 1.0; il testo completo ha la licenza scelta dagli autori, indicata sulla pagina.
Letto il 2026-10-19T05:17:58.131Z dalla pagina https://arxiv.org/catchup/cs.CR/2026-08-13?abs=True (consentita dal robots.txt di arxiv.org, con il suo crawl-delay).