{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,8,2]],"date-time":"2025-08-02T16:49:52Z","timestamp":1754153392463,"version":"3.41.2"},"reference-count":22,"publisher":"World Scientific Pub Co Pte Ltd","issue":"07","funder":[{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62376240"],"award-info":[{"award-number":["62376240"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"name":"S&T Program of Hebei","award":["226Z0701G","236Z0304G"],"award-info":[{"award-number":["226Z0701G","236Z0304G"]}]},{"DOI":"10.13039\/501100003787","name":"Natural Science Foundation of Hebei Province","doi-asserted-by":"publisher","award":["F2022203026","F2022203089","F2023203026"],"award-info":[{"award-number":["F2022203026","F2022203089","F2023203026"]}],"id":[{"id":"10.13039\/501100003787","id-type":"DOI","asserted-by":"publisher"}]},{"name":"Basic Innovation Research Cultivation Program of Yanshan Univer sity","award":["2024LGZD004"],"award-info":[{"award-number":["2024LGZD004"]}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Int. J. Soft. Eng. Knowl. Eng."],"published-print":{"date-parts":[[2025,7]]},"abstract":"<jats:p> As the world\u2019s most widely used operating system, Windows has long been a primary target for malware attacks, causing severe economic losses and threats to data security for users and enterprises. Existing detection methods often struggle with low accuracy when dealing with complex malware, suffering from high false-negative and false-positive rates. Additionally, malware detection in Windows faces challenges such as limited datasets, a lack of benign sample contrast and insufficient original feature information. To address these issues, we propose a malware detection method based on RGB image representation and heterogeneous neural network (MalRGBDet). First, we collected malware samples from the GitHub and VirusShare platforms, along with benign software from Windows systems, to build a dataset named MalDet. This data set contains unprocessed malicious and benign samples, providing original feature information and addressing the lack of benign samples in existing data sets. Next, we extracted three key features from the malware samples: code sections, data sections and API call sequences. These features closely relate to the behavior of malware and accurately describe its operations. We then transformed these features into uniformly sized RGB images, which helped reveal hidden patterns. Finally, we employ a heterogeneous neural network that integrates ResNet and AlexNet for classification. ResNet, with its deep architecture and residual learning mechanism, significantly enhances the model\u2019s representation capability and classification performance, thereby improving detection accuracy. Meanwhile, AlexNet\u2019s Dropout regularization strategy effectively boosts the model\u2019s generalization ability. In our data set of 1952 Windows software samples, MalRGBDet achieved more than 95% in accuracy, precision, recall and F1-score, improving these metrics by up to 4% compared to the latest methods. Furthermore, false-negative and false-positive rates were kept below 5%. <\/jats:p>","DOI":"10.1142\/s0218194025500305","type":"journal-article","created":{"date-parts":[[2025,6,20]],"date-time":"2025-06-20T04:44:57Z","timestamp":1750394697000},"page":"1009-1036","source":"Crossref","is-referenced-by-count":0,"title":["MalRGBDet: Windows Malware Detection Method Based on RGB Image Representation and Heterogeneous Neural Network"],"prefix":"10.1142","volume":"35","author":[{"ORCID":"https:\/\/orcid.org\/0009-0002-9320-9382","authenticated-orcid":false,"given":"Rong","family":"Ren","sequence":"first","affiliation":[{"name":"School of Information Science and Engineering, Yanshan University, Qinhuangdao 066004, Hebei, P.\u00a0R.\u00a0China"},{"name":"The Key Laboratory of Software Engineering, Yanshan University, Qinhuangdao 066004, Hebei, P.\u00a0R.\u00a0China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Hongchang","family":"Zhang","sequence":"additional","affiliation":[{"name":"School of Information Science and Engineering, Yanshan University, Qinhuangdao 066004, Hebei, P.\u00a0R.\u00a0China"},{"name":"The Key Laboratory of Software Engineering, Yanshan University, Qinhuangdao 066004, Hebei, P.\u00a0R.\u00a0China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-9867-8439","authenticated-orcid":false,"given":"Bing","family":"Zhang","sequence":"additional","affiliation":[{"name":"School of Information Science and Engineering, Yanshan University, Qinhuangdao 066004, Hebei, P.\u00a0R.\u00a0China"},{"name":"The Key Laboratory of Software Engineering, Yanshan University, Qinhuangdao 066004, Hebei, P.\u00a0R.\u00a0China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-9338-5605","authenticated-orcid":false,"given":"Haitao","family":"He","sequence":"additional","affiliation":[{"name":"School of Information Science and Engineering, Yanshan University, Qinhuangdao 066004, Hebei, P.\u00a0R.\u00a0China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-0655-4947","authenticated-orcid":false,"given":"Guoyan","family":"Huang","sequence":"additional","affiliation":[{"name":"School of Information Science and Engineering, Yanshan University, Qinhuangdao 066004, Hebei, P.\u00a0R.\u00a0China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-7159-1424","authenticated-orcid":false,"given":"Qian","family":"Wang","sequence":"additional","affiliation":[{"name":"School of Information Science and Engineering, Yanshan University, Qinhuangdao 066004, Hebei, P.\u00a0R.\u00a0China"},{"name":"The Key Laboratory of Software Engineering, Yanshan University, Qinhuangdao 066004, Hebei, P.\u00a0R.\u00a0China"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"219","published-online":{"date-parts":[[2025,7,16]]},"reference":[{"key":"S0218194025500305BIB003","doi-asserted-by":"publisher","DOI":"10.1145\/2016904.2016908"},{"key":"S0218194025500305BIB004","doi-asserted-by":"publisher","DOI":"10.1016\/j.jpdc.2020.03.012"},{"key":"S0218194025500305BIB005","doi-asserted-by":"publisher","DOI":"10.1016\/j.comnet.2020.107138"},{"key":"S0218194025500305BIB006","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2018.04.005"},{"key":"S0218194025500305BIB007","doi-asserted-by":"publisher","DOI":"10.1016\/j.jpdc.2022.10.001"},{"key":"S0218194025500305BIB008","doi-asserted-by":"publisher","DOI":"10.1109\/ICACCI.2014.6968547"},{"key":"S0218194025500305BIB009","doi-asserted-by":"publisher","DOI":"10.1109\/ICASSP.2013.6638293"},{"key":"S0218194025500305BIB010","doi-asserted-by":"publisher","DOI":"10.1145\/3372297.3417291"},{"key":"S0218194025500305BIB012","doi-asserted-by":"publisher","DOI":"10.1145\/3128572.3140442"},{"key":"S0218194025500305BIB013","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2022.102961"},{"key":"S0218194025500305BIB014","first-page":"12056","volume":"230","author":"Dabas N.","year":"2023","journal-title":"Expert Syst. Appl."},{"key":"S0218194025500305BIB015","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2024.3435362"},{"key":"S0218194025500305BIB016","doi-asserted-by":"publisher","DOI":"10.1038\/nature21056"},{"key":"S0218194025500305BIB017","doi-asserted-by":"publisher","DOI":"10.1142\/S0218194024500256"},{"key":"S0218194025500305BIB019","doi-asserted-by":"publisher","DOI":"10.1038\/nature14539"},{"key":"S0218194025500305BIB020","doi-asserted-by":"publisher","DOI":"10.1007\/s11416-018-0323-0"},{"key":"S0218194025500305BIB021","doi-asserted-by":"publisher","DOI":"10.1109\/ICASSP.2013.6639346"},{"key":"S0218194025500305BIB022","first-page":"6","volume":"5","author":"Kinga D.","year":"2015","journal-title":"Proc. Int. Conf. Learn. Represent."},{"key":"S0218194025500305BIB024","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.90"},{"key":"S0218194025500305BIB025","first-page":"1097","volume-title":"Advances in Neural Information Processing Systems","author":"Krizhevsky A.","year":"2012"},{"key":"S0218194025500305BIB027","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2017.74"},{"key":"S0218194025500305BIB031","doi-asserted-by":"publisher","DOI":"10.1109\/ISI58743.2023.10297217"}],"container-title":["International Journal of Software Engineering and Knowledge Engineering"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.worldscientific.com\/doi\/pdf\/10.1142\/S0218194025500305","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,7,23]],"date-time":"2025-07-23T02:50:06Z","timestamp":1753239006000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.worldscientific.com\/doi\/10.1142\/S0218194025500305"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,7]]},"references-count":22,"journal-issue":{"issue":"07","published-print":{"date-parts":[[2025,7]]}},"alternative-id":["10.1142\/S0218194025500305"],"URL":"https:\/\/doi.org\/10.1142\/s0218194025500305","relation":{},"ISSN":["0218-1940","1793-6403"],"issn-type":[{"type":"print","value":"0218-1940"},{"type":"electronic","value":"1793-6403"}],"subject":[],"published":{"date-parts":[[2025,7]]}}}