# High-resolution Image-based Malware Classification using Multiple Instance Learning

arXiv: https://arxiv.org/abs/2311.12760 · HTML: https://mlsanity.com/paper/2311.12760/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 15 of its 41 references that are in the map.
- First posted on arXiv 21 Nov 2023.

## Builds on (most cited first, 15 of 15)

- [Deep Residual Learning for Image Recognition](https://mlsanity.com/paper/1512.03385/) (2015)
- [Batch Normalization: Accelerating Deep Network Training by Reducing Internal Covariate Shift](https://mlsanity.com/paper/1502.03167/) (2015)
- [EfficientNet: Rethinking Model Scaling for Convolutional Neural Networks](https://mlsanity.com/paper/1905.11946/) (2019)
- [Rethinking the Inception Architecture for Computer Vision](https://mlsanity.com/paper/1512.00567/) (2015)
- [Attention-based Deep Multiple Instance Learning](https://mlsanity.com/paper/1802.04712/) (2018)
- [Malware Detection by Eating a Whole EXE](https://mlsanity.com/paper/1710.09435/) (2017)
- [Microsoft Malware Classification Challenge](https://mlsanity.com/paper/1802.10135/) (2018)
- [Exploring Adversarial Examples in Malware Detection](https://mlsanity.com/paper/1810.08280/) (2018)
- [Streaming convolutional neural networks for end-to-end learning with multi-megapixel images](https://mlsanity.com/paper/1911.04432/) (2019)
- [A Framework for Cluster and Classifier Evaluation in the Absence of Reference Labels](https://mlsanity.com/paper/2109.11126/) (2021)
- [Activation Analysis of a Byte-Based Deep Neural Network for Malware Classification](https://mlsanity.com/paper/1903.04717/) (2019)
- [Static Malware Detection & Subterfuge: Quantifying the Robustness of Machine Learning and Current Anti-Virus](https://mlsanity.com/paper/1806.04773/) (2018)
- [COPYCAT: Practical Adversarial Attacks on Visualization-Based Malware Detection](https://mlsanity.com/paper/1909.09735/) (2019)
- [Mapping the Internet: Modelling Entity Interactions in Complex Heterogeneous Networks](https://mlsanity.com/paper/2104.09650/) (2021)
- [Attacks on Visualization-Based Malware Detection: Balancing Effectiveness and Executability](https://mlsanity.com/paper/2109.10417/) (2021)

## Abstract (arXiv)

This paper proposes a novel method of classifying malware into families using high-resolution greyscale images and multiple instance learning to overcome adversarial binary enlargement. Current methods of visualisation-based malware classification largely rely on lossy transformations of inputs such as resizing to handle the large, variable-sized images. Through empirical analysis and experimentation, it is shown that these approaches cause crucial information loss that can be exploited. The proposed solution divides the images into patches and uses embedding-based multiple instance learning with a convolutional neural network and an attention aggregation function for classification. The implementation is evaluated on the Microsoft Malware Classification dataset and achieves accuracies of up to 96.6% on adversarially enlarged samples compared to the baseline of 22.8%. The Python code is available online at https://github.com/timppeters/MIL-Malware-Images .