# Malware Detection Using Frequency Domain-Based Image Visualization and Deep Learning

arXiv: https://arxiv.org/abs/2101.10578 · HTML: https://mlsanity.com/paper/2101.10578/

## Key facts

- Cited by 5 papers in the map (data through 14 Oct 2026).
- Builds on 8 of its 67 references that are in the map.
- First posted on arXiv 26 Jan 2021.

## Builds on (most cited first, 8 of 8)

- [Deep Residual Learning for Image Recognition](https://mlsanity.com/paper/1512.03385/) (2015)
- [Very Deep Convolutional Networks for Large-Scale Image Recognition](https://mlsanity.com/paper/1409.1556/) (2014)
- [CNN Features off-the-shelf: an Astounding Baseline for Recognition](https://mlsanity.com/paper/1403.6382/) (2014)
- [EMBER: An Open Dataset for Training Static PE Malware Machine Learning Models](https://mlsanity.com/paper/1804.04637/) (2018)
- [Imbalanced Malware Images Classification: a CNN based Approach](https://mlsanity.com/paper/1708.08042/) (2017)
- [Early Stage Malware Prediction Using Recurrent Neural Networks](https://mlsanity.com/paper/1708.03513/) (2017)
- [KiloGrams: Very Large N-Grams for Malware Classification](https://mlsanity.com/paper/1908.00200/) (2019)
- [Deep Transfer Learning for Static Malware Classification](https://mlsanity.com/paper/1812.07606/) (2018)

## Built on by (most cited first, 5 of 5)

- [HAPSSA: Holistic Approach to PDF Malware Detection Using Signal and Statistical Analysis](https://mlsanity.com/paper/2111.04703/) (2021)
- [OMD: Orthogonal Malware Detection Using Audio, Image, and Static Features](https://mlsanity.com/paper/2111.04710/) (2021)
- [Binary-30K: A Heterogeneous Dataset for Deep Learning in Binary Analysis and Malware Detection](https://mlsanity.com/paper/2511.22095/) (2025)
- [MalGrid: Visualization Of Binary Features In Large Malware Corpora](https://mlsanity.com/paper/2211.02696/) (2022)
- [ThreatVisionAI: A Hybrid CNN-ViT Framework for Image-Based Malware Classification](https://mlsanity.com/paper/2607.03653/) (2026)

## Abstract (arXiv)

We propose a novel method to detect and visualize malware through image classification. The executable binaries are represented as grayscale images obtained from the count of N-grams (N=2) of bytes in the Discrete Cosine Transform (DCT) domain and a neural network is trained for malware detection. A shallow neural network is trained for classification, and its accuracy is compared with deep-network architectures such as ResNet that are trained using transfer learning. Neither dis-assembly nor behavioral analysis of malware is required for these methods. Motivated by the visual similarity of these images for different malware families, we compare our deep neural network models with standard image features like GIST descriptors to evaluate the performance. A joint feature measure is proposed to combine different features using error analysis to get an accurate ensemble model for improved classification performance. A new dataset called MaleX which contains around 1 million malware and benign Windows executable samples is created for large-scale malware detection and classification experiments. Experimental results are quite promising with 96% binary classification accuracy on MaleX. The proposed model is also able to generalize well on larger unseen malware samples and the results compare favorably with state-of-the-art static analysis-based malware detection algorithms.