A Survey of Malware Detection Using Deep Learning

1. Introduction

• Malware is a persistent threat across diverse operating systems and devices, which the paper identifies as a major protection challenge.The introduction notes ongoing cyberattacks and the diversity of desktops, servers, routers, cameras, drones, and other devices.Source: §1 · p. 1
• The survey reviews static, dynamic, and hybrid malware detection across Windows, Android, Linux, MacOS, and iOS, including deep-learning strengths and weaknesses.Source: §1 · p. 1
• It covers attacker behavior, malware-to-image generation, and deep-learning malware-image classification, including EfficientNet B0–B7.Source: §1 · pp. 1–2
• The survey discusses feature reduction as a way to improve performance and reviews transfer learning for malware classification.Source: §1 · p. 1
• It reviews natural-language processing for malware classification and deep-learning models for cryptographer ransomware.Source: §1 · p. 1
• It addresses trust in deep-learning results through explainable AI and examines reliability and security challenges from adversarial attacks.Source: §1 · p. 1

2. Mechanics of Malware Attacts

• Attackers commonly use a malicious document or executable to trick victims into running code that can download further malware.The document is often a compromised vector rather than the attack’s final malware.Source: §2 · p. 2

2.1. PDF and Document Files

• PDF analysis examines three components: objects forming the document structure, keywords controlling its behavior, and stored or encoded data.PDF objects include a header that must appear in the first 1024 bytes; unrelated data there can evade signature-based detection.Source: §2.1 · p. 2
• PDF keywords such as /OpenAction and /AA can trigger automatic actions, while /JavaScript or /JS can identify scripts used to launch exploits or download malware.A malicious PDF may point /OpenAction to JavaScript that executes when the document opens.Source: §2.1 · p. 2
• PDFs can mix hex, octal, and ASCII encodings to hide JavaScript or URLs, and filters can further encode or compress data streams.In Fig. 2, an OpenAction leads through three objects to JavaScript in an ASCIIHex-encoded, Zlib-compressed stream; Fig. 3’s script requests files from two hosts and runs an executable.Source: §2.1 · p. 3, Figure 2 · p. 3
• Script obfuscation can add extra lines, obscure data, or substitute variable names.These techniques make a program’s format harder to interpret, as illustrated in Fig. 4.Source: §2.1 · p. 3, Figure 4 · p. 3

3. Nature of Malware Code

• Malware is code or a program designed to compromise systems, steal information, or disrupt normal operations.Its characteristics and behaviors vary with its type and objectives.Source: §3 · p. 3

3.1. Obfuscation

• Obfuscation obscures code’s meaning or makes it difficult to analyze, sometimes using encryption or compression to hide intent or evade signature-based detection.Source: §3.1 · p. 3

3.2. Payload Delivery

• A malware payload is the malicious action the code intends to execute, such as stealing data, launching a DDoS attack, encrypting files, or providing backdoor access.Source: §3.2 · p. 4

3.3. Command and Control (C&C)

• Command-and-control channels let attackers remotely manage infected systems, update malware, and receive stolen data.Source: §3.3 · p. 4

3.4. Self-Replication

• Some malware self-replicates across networks, devices, or files by exploiting vulnerabilities, attaching to legitimate files, or using network resources.Source: §3.4 · p. 4

3.5. Exploitation

• Malware can exploit software, operating-system, network, or user-behavior weaknesses to gain unauthorized access or control.The section also names social engineering as a means of compromising systems.Source: §3.5 · p. 4

3.6. Polymorphism

• Polymorphic or metamorphic malware changes its code structure or appearance while preserving functionality, making antivirus detection and blocking more difficult.Source: §3.6 · p. 4

3.7. Ransomware

• Ransomware combines cryptography with malware, encrypts a victim’s data, and commonly demands cryptocurrency payment.WannaCry locks files with different keys and uses RSA; the described ransom demand rose from $300 to $600 in Bitcoin. A Conti attack on Costa Rica’s government prompted demands of $10 million and then $20 million.Source: §3.7 · p. 4

4. Overview & Malware Detection

• Static methods inspect executable files without running them, dynamic methods analyze behavior in a controlled environment, and hybrid methods combine both analyses.Prior work also applies static features, dynamic-event encoding, and combined static-dynamic features to malware detection.Source: §4 · pp. 4–5

5. Data for Malware Detection

• System logs from devices and infrastructure support breach detection, suspicious-activity tracking, troubleshooting, and optimization, but appear in varied formats.Syslog and Windows logs each have many differently formatted components useful for investigation.Source: §5 · p. 5, Table 1 · p. 5

6. Generating Malware Images for Deep Learning

• Malware files can be converted into grayscale or RGB pixel matrices, with grayscale values encoding brightness and RGB channels combining into colors.Grayscale values range from 0 (black) to 255 (white); RGB uses three channels with values from 0 to 255.Source: §6 · p. 5, Figure 6 · p. 5, Figure 7 · p. 5
• Image-generation approaches include byte-transition Markov images, bigram-frequency pixel values with DCT, entropy maps, and SimHash-based grayscale images.Yuan et al. use byte transfer probabilities; other described methods include Mohammed et al. [8], Euh et al., and Ni et al..Source: §6 · pp. 5–6

7. Image Classification for Malware Detection

• Image classification can automatically extract malware features and explore distinguishing patterns and correlations among malware families.Reviewed approaches include grayscale and RGB images, and global image features are common.Source: §7 · p. 6
• 99.12% accuracy was reported for semi-supervised obfuscated-malware detection, while DFS-MC and DBFS-MC achieved 98.61% accuracy on MalImg.Darem et al. report the former result; Asam et al. report the latter.Source: §7 · p. 6
• Other reviewed approaches include Markov-image CNNs, RNN-CNN ensembles, Siamese networks for obfuscated malware, and SVM classification across color modes.Chauhan et al. report 96% accuracy in RGB, HSV, grayscale, and BGR modes.Source: §7 · p. 6
• 96.59% and 98.94% average accuracies were reported for CoLab with VGG16 and an SVM on VX-Heaven and BIG-2015, respectively.Xiao et al. convert PE file sections into colored label-box images.Source: §7 · p. 6

8. Feature Reduction for Efficient Malware Detection

• Feature reduction selects a subset of features or maps them into a lower-dimensional representation, which may improve or speed classification.Feature extraction represents each new feature as a function of the original features, with m < n; feature selection instead chooses a subset.Source: §8 · p. 6

9. Deep Transfer Leaning models for Malware detection

• Transfer learning reuses knowledge from a pretrained source model, often trained on ImageNet, for malware-image datasets that differ visually from ImageNet.The review notes that pretraining still seems to help despite the visual difference.Source: §9 · p. 7

9.1. Using feature extraction

• Feature extraction keeps a pretrained convolutional base and its weights frozen while replacing its classifier with newly trained dense layers for malware classification.The convolutional representations are described as generic and reusable across tasks.Source: §9.1 · p. 7

9.2. Using fine tuning

• Fine-tuning unfreezes selected upper convolutional layers and jointly trains them with added dense layers, adapting reused representations to the target task.Earlier layers can remain frozen while later layers learn new representations.Source: §9.2 · pp. 7–8
• Inception-V4 was most effective among ten evaluated models for malware-image classification, and training times increased with input image size.The models were evaluated on the authors’ RGB malware-image dataset, Malimg, and the Microsoft Malware Dataset.Source: §9.2 · p. 8
• The review reports that transfer learning can classify malware images while retraining few parameters, and argues that wider, deeper models may improve performance.It also notes that ResNet-101 and ResNet-50 have similar malware-detection accuracies despite their different depths.Source: §9.3 · p. 8

10. Natural Language Processing for Malware Classification

• Malware text sources include executables, documents, macros, logs, emails, and network activity; preprocessing removes redundant fragments before tokenization and encoding.Representations include BoW, TFIDF, term-document matrices, n-grams, one-hot and ASCII encodings, and Word2vec and Sent2vec embeddings.Source: §10 · pp. 8–9
• N-gram sequences with CNN and LSTM architectures, alongside Swin-T and Sequencer2D-L experiments, achieved 99.91% accuracy in a cited malware-classification method.Bensaoud and Kalita use API calls and opcodes; current word embeddings are described as carrying limited semantic and contextual significance for malware classification.Source: §10 · p. 10

10.1. Sequence to Sequence Neural Models

• In encoder-decoder models, a fixed context vector compresses the input sequence, but may fail to retain dependencies in long sentences.Attention can use encoder states with the current decoder state to form a dynamic context and adaptively select input information during decoding.Source: §10.1 · p. 10
• Attention can dynamically prioritize input-sequence information, and malware studies apply it to LSTM, CNN, and local-attention models.Attention-based approaches are reported to improve classification accuracy, but also to incur heavy computation; attention may help address longer sequences and dependencies.Source: §10.1 · pp. 10–11
• Reviewed malware-detection methods use diverse techniques and distinct datasets, so their reported comparisons are not based on the same dataset.The review calls for a comprehensive overview of comparative performance across methods and scenarios.Source: §10.1 · p. 11

11.1. Operations of Cryptography

• Cryptographic algorithms include symmetric, asymmetric, and hash types, which serve different purposes but work together in cryptographic systems.The section describes cryptography as protecting information through encryption and decryption.Source: §11.1 · p. 12
• Cryptosystems transform plaintext into ciphertext and back using an algorithm and key; symmetric encryption and decryption use the same shared secret.The key is not safe to send with the encrypted message, so another communication mode is needed to transmit it.Source: §11.1 · p. 12
• Cipher-type detection is framed as classification: statistical features can help machine learning identify a cipher rather than relying only on trial-and-error solvers.The passage names man-in-the-middle, brute-force, ciphertext-only, known-plaintext, and chosen-plaintext attacks among methods that may discover a key.Source: §11.1 · p. 12

11.2. Connection Between Deep Learning and Cryptography

• Neural networks can classify ciphertext using computed features such as n-gram frequencies, index of coincidence, and double-letter presence.The described network outputs 90% Seriated Playfair and 10% Bazeries; Baksi applied MLP, CNN, and LSTM models to differential attacks on the GIMLI cipher and hash.Source: §11.2 · pp. 12–13

11. Deep Learning for Cryptographic Ransomware

• Kim et al. detect crypto-ransomware by identifying block ciphers, while other cited work addresses encryption, unlabeled ransomware, and Android cryptographic API vulnerabilities.Ding et al. proposed DeepEDN for encrypting and decrypting medical images; Sharmeen et al. studied unlabeled ransomware, and Fischer et al. reported an average AUC-ROC of 99.2%.Source: §11.2 · p. 13

• XAI can help analysts understand model decisions and identify false positives, false negatives, evasion vulnerabilities, and potentially missed malware strains.The passage names LIME and DeepLIFT as techniques for examining important features and decision processes.Source: §12 · p. 13
• Malware-security studies use explanation methods to identify influential opcodes, examine learned patterns, test feature removal, and evaluate explanation correctness.Examples include LIME, LRP and DeepLift, and seven methods assessed by Lin et al..Source: §12 · p. 14
• XAI's effectiveness in malware detection still requires further investigation to understand its performance.The section also cites LEMNA, which generates interpretable features to explain how security samples are classified.Source: §12 · p. 14

• Adversarial examples are crafted to induce incorrect predictions, evade detection, or poison models; Malfox and SAGE are described generation approaches.Malfox uses conditional GANs against black-box detectors, while SAGE combines gradient-based and gradient-free methods.Source: §13 · pp. 14–15
• Defense development can be computationally expensive and potentially affect model performance, while adversarial examples can impair generalization on unseen data.Generating examples can also be computationally intensive, particularly for large datasets and complex models, which may hinder practical deployment.Source: §13 · p. 15
• Related work spans GAN-based black-box attacks, Windows PE attack surveys, Android app attacks, and interpreted ELF-malware detection.Other cited work addresses adversarial iris recognition and debugging adversarial-example optimization.Source: §13 · p. 15

• More experimentation is needed to understand deep learning's capabilities and limitations in malware detection and classification.The conclusion notes growing research attention particularly in malware image classification and cipher cryptanalysis.Source: §14 · p. 15
• Deep learning may reduce the need for static and dynamic analysis and can discover suspicious patterns.Source: §14 · p. 15
• Future work may develop more accurate, robust, scalable, and efficient models across operating systems, with multi-task and transfer learning potentially valuable for classifying malware types.Source: §14 · p. 15
• The conclusion identifies hyperparameter optimization, fine-tuning, dataset size and quality, feature overrepresentation, XAI, and adversarial perturbations as challenges or research directions.Source: §14 · p. 15

15. Appendix A: File Types

• Appendix A enumerates file extensions, including document, media, code, and archive formats.Source: §15 · p. 19

16. Appendix B: The Accuracy and Loss Curves Plots

• Figures 20–25 show training and testing accuracy and loss for EfficientNetB1, EfficientNetB2, EfficientNetB3, EfficientNetB4, EfficientNetB5, and EfficientNetB6.Source: Figure 20 · p. 19, Figure 21 · p. 19, Figure 22 · p. 19