# MalGrid: Visualization Of Binary Features In Large Malware Corpora

arXiv: https://arxiv.org/abs/2211.02696 · HTML: https://mlsanity.com/paper/2211.02696/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 8 of its 35 references that are in the map.
- First posted on arXiv 4 Nov 2022.

## Builds on (most cited first, 8 of 8)

- [Deep Residual Learning for Image Recognition](https://mlsanity.com/paper/1512.03385/) (2015)
- [Very Deep Convolutional Networks for Large-Scale Image Recognition](https://mlsanity.com/paper/1409.1556/) (2014)
- [UMAP: Uniform Manifold Approximation and Projection for Dimension Reduction](https://mlsanity.com/paper/1802.03426/) (2018)
- [Xception: Deep Learning with Depthwise Separable Convolutions](https://mlsanity.com/paper/1610.02357/) (2016)
- [Transfer Learning for Image-Based Malware Classification](https://mlsanity.com/paper/1903.11551/) (2019)
- [Malware Detection Using Frequency Domain-Based Image Visualization and Deep Learning](https://mlsanity.com/paper/2101.10578/) (2021)
- [HAPSSA: Holistic Approach to PDF Malware Detection Using Signal and Statistical Analysis](https://mlsanity.com/paper/2111.04703/) (2021)
- [OMD: Orthogonal Malware Detection Using Audio, Image, and Static Features](https://mlsanity.com/paper/2111.04710/) (2021)

## Abstract (arXiv)

The number of malware is constantly on the rise. Though most new malware are modifications of existing ones, their sheer number is quite overwhelming. In this paper, we present a novel system to visualize and map millions of malware to points in a 2-dimensional (2D) spatial grid. This enables visualizing relationships within large malware datasets that can be used to develop triage solutions to screen different malware rapidly and provide situational awareness. Our approach links two visualizations within an interactive display. Our first view is a spatial point-based visualization of similarity among the samples based on a reduced dimensional projection of binary feature representations of malware. Our second spatial grid-based view provides a better insight into similarities and differences between selected malware samples in terms of the binary-based visual representations they share. We also provide a case study where the effect of packing on the malware data is correlated with the complexity of the packing algorithm.