Joon-soo Shim, Chan-ho Lee, Jong-geun Choi, Hyuk-jin Kwon, Journal of Internet Computing and Services, Vol. 27, No. 1, pp. 27-38, Feb. 2026
10.7472/jksii.2026.27.1.27, Full Text:  HTML
Keywords: Malware classification, Transfer Learning, Deep Learning, ConvNeXt, Dilated Convolution, channel attention, Low-label Learning, Image-based Malware Detection, Generalization performance, cybersecurity

Abstract

This study proposes a malware image classification model designed to maintain high classification performance even under limited label conditions. The proposed model is based on the ConvNeXt-Tiny backbone and integrates Dilated Convolution to expand the global receptive field and a Channel Attention module to emphasize the relative importance of feature channels. This combination enables the model to effectively learn complex visual patterns in malware images. Experiments were conducted on three public datasets BIG2015, Malevis, and SOREL-20M through an ablation study comparing the Baseline, Dilated-only, Attention-only, and Full configurations. As a result, the proposed model demonstrated performance improvement tendencies across most evaluation metrics under 1%, 5%, 50%, and 100% label ratio conditions, and notably maintained stable classification performance even in the low-label scenario. These findings demonstrate that combining Dilated Convolution and Channel Attention provides an effective and label-efficient approach for enhancing the generalization capability of CNN-based malware classifiers, making it suitable for deployment in real-world security analysis environments.

Statistics
Cite this article