# Deep Transfer Learning for Static Malware Classification

arXiv: https://arxiv.org/abs/1812.07606 · HTML: https://mlsanity.com/paper/1812.07606/

## Key facts

- Cited by 7 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 18 Dec 2018.

## Built on by (most cited first, 7 of 7)

- [MalNet: A Large-Scale Image Database of Malicious Software](https://mlsanity.com/paper/2102.01072/) (2021)
- [Malware Detection Using Frequency Domain-Based Image Visualization and Deep Learning](https://mlsanity.com/paper/2101.10578/) (2021)
- [Explainable Artificial Intelligence (XAI) for Malware Analysis: A Survey of Techniques, Applications, and Open Challenges](https://mlsanity.com/paper/2409.13723/) (2024)
- [Towards Interpretable Ensemble Learning for Image-based Malware Detection](https://mlsanity.com/paper/2101.04889/) (2021)
- [Towards interpreting ML-based automated malware detection models: a survey](https://mlsanity.com/paper/2101.06232/) (2021)
- [On deceiving malware classification with section injection](https://mlsanity.com/paper/2208.06092/) (2022)
- [Generative AI-Based Effective Malware Detection for Embedded Computing Systems](https://mlsanity.com/paper/2404.02344/) (2024)

## Abstract (arXiv)

We propose to apply deep transfer learning from computer vision to static malware classification. In the transfer learning scheme, we borrow knowledge from natural images or objects and apply to the target domain of static malware detection. As a result, training time of deep neural networks is accelerated while high classification performance is still maintained. We demonstrate the effectiveness of our approach on three experiments and show that our proposed method outperforms other classical machine learning methods measured in accuracy, false positive rate, true positive rate and F1 score (in binary classification). We instrument an interpretation component to the algorithm and provide interpretable explanations to enhance security practitioners' trust to the model. We further discuss a convex combination scheme of transfer learning and training from scratch for enhanced malware detection, and provide insights of the algorithmic interpretation of vision-based malware classification techniques.