{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,3,5]],"date-time":"2026-03-05T14:31:20Z","timestamp":1772721080231,"version":"3.50.1"},"reference-count":42,"publisher":"Springer Science and Business Media LLC","issue":"1","license":[{"start":{"date-parts":[[2024,11,26]],"date-time":"2024-11-26T00:00:00Z","timestamp":1732579200000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"},{"start":{"date-parts":[[2024,11,26]],"date-time":"2024-11-26T00:00:00Z","timestamp":1732579200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"}],"funder":[{"name":"National Key Research and Development Program of China","award":["2020YFA0714200"],"award-info":[{"award-number":["2020YFA0714200"]}]}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":["Cybersecurity"],"abstract":"<jats:title>Abstract<\/jats:title><jats:p>Malware classification has been successful in utilizing machine learning methods. However, it is limited by the reliance on a large number of high-quality labeled datasets and the issue of overfitting. These limitations hinder the accurate classification of advanced malware with only a few samples available. Meta-learning methods offer a solution by allowing models to quickly adapt to new tasks, even with a small number of samples. However, the effectiveness of meta-learning approaches in malware classification varies due to the diverse nature of malware types. Most meta-learning-based methodologies for malware classification either focus solely on data augmentation or utilize existing neural networks and learning rate schedules to adapt to the meta-learning model. These approaches do not consider the integration of both processes or tailor the neural network and learning rate schedules to the specific task. As a result, the classification performance and generalization capabilities are suboptimal. In this paper, we propose a multi-improved model-agnostic meta-learning (MI-MAML) model that aims to address the challenges encountered in few-shot malware classification. Specifically, we propose two data augmentation techniques to improve the classification performance of few-shot malware. These techniques involve utilizing grayscale images and the Lab color space. Additionally, we customize neural network architectures and learning rate schemes based on the representative few-shot classification method, MAML, to further enhance the model\u2019s classification performance and generalization ability for the task of few-shot malware classification. The results obtained from multiple few-shot malware datasets demonstrate that MI-MAML outperforms other models in terms of categorical accuracy, precision, and f1-score. Furthermore, we have conducted ablation experiments to validate the effectiveness of each stage of our work.<\/jats:p>","DOI":"10.1186\/s42400-024-00314-9","type":"journal-article","created":{"date-parts":[[2024,11,26]],"date-time":"2024-11-26T00:02:12Z","timestamp":1732579332000},"update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":5,"title":["Mi-maml: classifying few-shot advanced malware using multi-improved model-agnostic meta-learning"],"prefix":"10.1186","volume":"7","author":[{"given":"Yulong","family":"Ji","sequence":"first","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Kunjin","family":"Zou","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Bin","family":"Zou","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"297","published-online":{"date-parts":[[2024,11,26]]},"reference":[{"key":"314_CR1","unstructured":"Antoniou A, Edwards H, Storkey A (2019) How to train your MAML. In: International conference on learning representations. https:\/\/openreview.net\/forum?id=HJGven05Y7"},{"key":"314_CR2","doi-asserted-by":"crossref","unstructured":"Arp D, Spreitzenbarth M, Hubner M, et\u00a0al (2014) Drebin: effective and explainable detection of android malware in your pocket. In: Ndss, pp 23\u201326","DOI":"10.14722\/ndss.2014.23247"},{"issue":"1","key":"314_CR3","doi-asserted-by":"publisher","first-page":"e1499","DOI":"10.1002\/wics.1499","volume":"13","author":"TI Cannings","year":"2021","unstructured":"Cannings TI (2021) Random projections: data perturbation for classification problems. Wiley Interdiscip Rev Comput Stat 13(1):e1499","journal-title":"Wiley Interdiscip Rev Comput Stat"},{"issue":"4","key":"314_CR4","doi-asserted-by":"publisher","first-page":"4248","DOI":"10.1109\/TNSM.2022.3200866","volume":"19","author":"Y Chai","year":"2022","unstructured":"Chai Y, Qiu J, Yin L et al (2022) From data and model levels: Improve the performance of few-shot malware classification. IEEE Trans Netw Serv Manage 19(4):4248\u20134261","journal-title":"IEEE Trans Netw Serv Manage"},{"key":"314_CR5","doi-asserted-by":"crossref","unstructured":"Chen Z, Brophy E, Ward T (2021) Malware classification using static disassembly and machine learning. arXiv preprint arXiv:2201.07649","DOI":"10.36227\/techrxiv.17259806.v1"},{"key":"314_CR6","unstructured":"Cyber-research (2023) Aptmalware. https:\/\/github.com\/cyber-research\/APTMalware. Accessed 20 Jun 2023"},{"key":"314_CR7","unstructured":"Finn C, Abbeel P, Levine S (2017) Model-agnostic meta-learning for fast adaptation of deep networks. In: International conference on machine learning, PMLR, pp 1126\u20131135"},{"key":"314_CR8","doi-asserted-by":"publisher","first-page":"959","DOI":"10.1007\/s00500-008-0392-y","volume":"13","author":"S Garc\u00eda","year":"2009","unstructured":"Garc\u00eda S, Fern\u00e1ndez A, Luengo J et al (2009) A study of statistical techniques and performance measures for genetics-based machine learning: accuracy and interpretability. Soft Comput 13:959\u2013977","journal-title":"Soft Comput"},{"key":"314_CR9","doi-asserted-by":"publisher","DOI":"10.1016\/j.jnca.2019.102526","volume":"153","author":"D Gibert","year":"2020","unstructured":"Gibert D, Mateu C, Planes J (2020) The rise of machine learning for detection and classification of malware: research developments, trends and challenges. J Netw Comput Appl 153:102526","journal-title":"J Netw Comput Appl"},{"key":"314_CR10","doi-asserted-by":"crossref","unstructured":"Gowda SN, Yuan C (2019) Colornet: investigating the importance of color spaces for image classification. In: Computer vision\u2013ACCV 2018: 14th Asian conference on computer vision, Perth, Australia, December 2\u20136, 2018, Revised Selected Papers, Part IV 14, Springer, pp 581\u2013596","DOI":"10.1007\/978-3-030-20870-7_36"},{"key":"314_CR11","doi-asserted-by":"crossref","unstructured":"Guo H, Zhang X, Wang Y, et\u00a0al (2022) Few-shot malware traffic classification method using network traffic and meta transfer learning. In: 2022 IEEE 96th vehicular technology conference (VTC2022-Fall), IEEE, pp 1\u20135","DOI":"10.1109\/VTC2022-Fall57202.2022.10012914"},{"key":"314_CR12","doi-asserted-by":"crossref","unstructured":"He K, Zhang X, Ren S, et\u00a0al (2016) Deep residual learning for image recognition. In: Proceedings of the IEEE conference on computer vision and pattern recognition, pp 770\u2013778","DOI":"10.1109\/CVPR.2016.90"},{"issue":"4","key":"314_CR13","doi-asserted-by":"publisher","first-page":"3177","DOI":"10.1109\/TPWRS.2022.3169389","volume":"37","author":"Y He","year":"2022","unstructured":"He Y, Luo F, Ranzi G (2022) Transferrable model-agnostic meta-learning for short-term household load forecasting with limited training data. IEEE Trans Power Syst 37(4):3177\u20133180","journal-title":"IEEE Trans Power Syst"},{"key":"314_CR14","unstructured":"Howard AG, Zhu M, Chen B, et\u00a0al (2017) Mobilenets: efficient convolutional neural networks for mobile vision applications. arXiv preprint arXiv:1704.04861"},{"key":"314_CR15","doi-asserted-by":"crossref","unstructured":"Hu W, Tan Y (2022) Generating adversarial malware examples for black-box attacks based on GAN. In: International conference on data mining and big data, Springer, pp 409\u2013423","DOI":"10.1007\/978-981-19-8991-9_29"},{"key":"314_CR16","doi-asserted-by":"crossref","unstructured":"Huang G, Liu Z, Van Der\u00a0Maaten L, et\u00a0al (2017) Densely connected convolutional networks. In: Proceedings of the IEEE conference on computer vision and pattern recognition, pp 4700\u20134708","DOI":"10.1109\/CVPR.2017.243"},{"key":"314_CR17","doi-asserted-by":"crossref","unstructured":"Joyce RJ, Amlani D, Nicholas C, et\u00a0al (2022) MOTIF: a large malware reference dataset with ground truth family labels. In: The AAAI-22 workshop on artificial intelligence for cyber security (AICS). https:\/\/github.com\/boozallen\/MOTIF, arXiv:2111.15031v1","DOI":"10.1016\/j.cose.2022.102921"},{"key":"314_CR18","first-page":"1","volume":"72","author":"M Karnati","year":"2023","unstructured":"Karnati M, Seal A, Bhattacharjee D et al (2023) Understanding deep learning techniques for recognition of human emotions using facial expressions: a comprehensive survey. IEEE Trans Instrum Meas 72:1\u201331","journal-title":"IEEE Trans Instrum Meas"},{"key":"314_CR19","first-page":"507","volume":"2022","author":"S Kasarapu","year":"2022","unstructured":"Kasarapu S, Shukla S, Hassan R et al (2022) CAD-FSL: code-aware data generation based few-shot learning for efficient malware detection. Proc Great Lakes Symp VLSI 2022:507\u2013512","journal-title":"Proc Great Lakes Symp VLSI"},{"key":"314_CR20","doi-asserted-by":"publisher","DOI":"10.1016\/j.jnca.2023.103760","volume":"220","author":"H Kheddar","year":"2023","unstructured":"Kheddar H, Himeur Y, Awad AI (2023) Deep transfer learning for intrusion detection in industrial control networks: a comprehensive review. J Netw Comput Appl 220:103760","journal-title":"J Netw Comput Appl"},{"key":"314_CR21","doi-asserted-by":"publisher","first-page":"334","DOI":"10.1016\/j.future.2021.06.029","volume":"125","author":"S Kumar","year":"2021","unstructured":"Kumar S et al (2021) MCFT-CNN: Malware classification with fine-tune convolution neural networks using traditional and transfer learning in internet of things. Futur Gener Comput Syst 125:334\u2013351","journal-title":"Futur Gener Comput Syst"},{"key":"314_CR22","doi-asserted-by":"crossref","unstructured":"Li X, Li A (2019) An improved image enhancement method based on lab color space retinex algorithm. In: Tenth international conference on graphics and image processing (ICGIP 2018), SPIE, pp 756\u2013765","DOI":"10.1117\/12.2524449"},{"key":"314_CR23","unstructured":"Li Z, Zhou F, Chen F, et\u00a0al (2017) Meta-SGD: learning to learn quickly for few-shot learning. arXiv preprint arXiv:1707.09835"},{"key":"314_CR24","doi-asserted-by":"publisher","DOI":"10.1016\/j.patcog.2022.108586","volume":"126","author":"S Luo","year":"2022","unstructured":"Luo S, Li Y, Gao P et al (2022) Meta-seg: a survey of meta-learning for image segmentation. Pattern Recogn 126:108586","journal-title":"Pattern Recogn"},{"key":"314_CR25","doi-asserted-by":"crossref","unstructured":"Madhukar B, Narendra R (2013) Lanczos resampling for the digital processing of remotely sensed images. In: Proceedings of international conference on VLSI, communication, advanced devices, signals & systems and networking (VCASAN-2013), Springer, pp 403\u2013411","DOI":"10.1007\/978-81-322-1524-0_48"},{"key":"314_CR26","doi-asserted-by":"crossref","unstructured":"McLaughlin N, Del\u00a0Rincon JM (2022) Data augmentation for opcode sequence based malware detection. In: 2022 cyber research conference-Ireland (Cyber-RCI), IEEE, pp 1\u20138","DOI":"10.1109\/Cyber-RCI55324.2022.10032676"},{"key":"314_CR27","doi-asserted-by":"crossref","unstructured":"Nataraj L, Karthikeyan S, Jacob G, et\u00a0al (2011) Malware images: visualization and automatic classification. In: Proceedings of the 8th international symposium on visualization for cyber security, pp 1\u20137","DOI":"10.1145\/2016904.2016908"},{"key":"314_CR28","unstructured":"Parnami A, Lee M (2022) Learning from few examples: a summary of approaches to few-shot learning. arXiv preprint arXiv:2203.04291"},{"key":"314_CR29","doi-asserted-by":"crossref","unstructured":"Prasad S, Kumar P, Sinha KP (2014) Grayscale to color map transformation for efficient image analysis on low processing devices. In: Advances in intelligent informatics - proceedings of the third international symposium on intelligent informatics, ISI 2014, September 24-27, 2014, Greater Noida, Delhi, India, vol 320. Springer, pp 9\u201318","DOI":"10.1007\/978-3-319-11218-3_2"},{"key":"314_CR30","doi-asserted-by":"crossref","unstructured":"Rong C, Gou G, Hou C, et\u00a0al (2021) UMVD-FSL: unseen malware variants detection using few-shot learning. In: 2021 International joint conference on neural networks (IJCNN), IEEE, pp 1\u20138","DOI":"10.1109\/IJCNN52387.2021.9533759"},{"issue":"1","key":"314_CR31","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1186\/s40537-019-0197-0","volume":"6","author":"C Shorten","year":"2019","unstructured":"Shorten C, Khoshgoftaar TM (2019) A survey on image data augmentation for deep learning. J Big Data 6(1):1\u201348","journal-title":"J Big Data"},{"key":"314_CR32","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1145\/3582688","volume":"55","author":"Y Song","year":"2023","unstructured":"Song Y, Wang T, Cai P et al (2023) A comprehensive survey of few-shot learning: evolution, applications, challenges, and opportunities. ACM Comput Surv 55:1\u201340","journal-title":"ACM Comput Surv"},{"issue":"8","key":"314_CR33","doi-asserted-by":"publisher","first-page":"2847","DOI":"10.3390\/app10082847","volume":"10","author":"Z Tang","year":"2020","unstructured":"Tang Z, Wang P, Wang J (2020) ConvProtoNet: deep prototype induction towards better class representation for few-shot malware classification. Appl Sci 10(8):2847","journal-title":"Appl Sci"},{"issue":"4","key":"314_CR34","doi-asserted-by":"publisher","first-page":"800","DOI":"10.3390\/jcp2040041","volume":"2","author":"Tayyab UeH","year":"2022","unstructured":"UeH Tayyab, Khan FB, Durad MH et al (2022) A survey of the recent trends in deep learning based malware detection. J Cybersecur Priv 2(4):800\u2013829","journal-title":"J Cybersecur Priv"},{"key":"314_CR35","doi-asserted-by":"crossref","unstructured":"Tran TK, Sato H, Kubo M (2019) Image-based unknown malware classification with few-shot learning models. In: 2019 seventh international symposium on computing and networking workshops (CANDARW), IEEE, pp 401\u2013407","DOI":"10.1109\/CANDARW.2019.00075"},{"key":"314_CR36","unstructured":"Triantafillou E, Zhu T, Dumoulin V, et\u00a0al. (2020) Meta-dataset: a dataset of datasets for learning to learn from few examples. In: International conference on learning representations"},{"issue":"20","key":"314_CR37","doi-asserted-by":"publisher","first-page":"4299","DOI":"10.3390\/electronics12204299","volume":"12","author":"V Vasani","year":"2023","unstructured":"Vasani V, Bairwa AK, Joshi S et al (2023) Comprehensive analysis of advanced techniques and vital tools for detecting malware intrusion. Electronics 12(20):4299","journal-title":"Electronics"},{"key":"314_CR38","doi-asserted-by":"publisher","DOI":"10.3389\/fpls.2021.735230","volume":"12","author":"S Wang","year":"2022","unstructured":"Wang S, Han Y, Chen J et al (2022) Weed density extraction based on few-shot learning through UAV remote sensing RGB and multispectral images in ecological irrigation area. Front Plant Sci 12:735230","journal-title":"Front Plant Sci"},{"issue":"1","key":"314_CR39","doi-asserted-by":"publisher","first-page":"67","DOI":"10.1016\/j.dcan.2022.03.007","volume":"9","author":"A Yang","year":"2023","unstructured":"Yang A, Lu C, Li J et al (2023) Application of meta-learning in cyberspace security: a survey. Digit Commun Netw 9(1):67\u201378","journal-title":"Digit Commun Netw"},{"key":"314_CR40","first-page":"1359","volume":"51","author":"DD Zhang","year":"2023","unstructured":"Zhang DD, Song YF, Liu S (2023) MalMKNet: a multi-scale convolutional neural network used for malware classification. ACTA ELECTONICA SINICA 51:1359\u20131369","journal-title":"ACTA ELECTONICA SINICA"},{"issue":"1","key":"314_CR41","doi-asserted-by":"publisher","first-page":"61","DOI":"10.1889\/1.1985127","volume":"5","author":"X Zhang","year":"1997","unstructured":"Zhang X, Wandell BA (1997) A spatial extension of CIELAB for digital color-image reproduction. J Soc Inform Displ 5(1):61\u201363","journal-title":"J Soc Inform Displ"},{"key":"314_CR42","doi-asserted-by":"crossref","unstructured":"Zhu J, Jang-Jaccard J, Welch I, et\u00a0al (2023) Relation-aware based siamese denoising autoencoder for malware few-shot classification. Available at SSRN 4367408","DOI":"10.2139\/ssrn.4367408"}],"container-title":["Cybersecurity"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1186\/s42400-024-00314-9.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/article\/10.1186\/s42400-024-00314-9\/fulltext.html","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1186\/s42400-024-00314-9.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2024,11,26]],"date-time":"2024-11-26T01:03:00Z","timestamp":1732582980000},"score":1,"resource":{"primary":{"URL":"https:\/\/cybersecurity.springeropen.com\/articles\/10.1186\/s42400-024-00314-9"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2024,11,26]]},"references-count":42,"journal-issue":{"issue":"1","published-online":{"date-parts":[[2024,12]]}},"alternative-id":["314"],"URL":"https:\/\/doi.org\/10.1186\/s42400-024-00314-9","relation":{},"ISSN":["2523-3246"],"issn-type":[{"value":"2523-3246","type":"electronic"}],"subject":[],"published":{"date-parts":[[2024,11,26]]},"assertion":[{"value":"18 October 2023","order":1,"name":"received","label":"Received","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"30 July 2024","order":2,"name":"accepted","label":"Accepted","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"26 November 2024","order":3,"name":"first_online","label":"First Online","group":{"name":"ArticleHistory","label":"Article History"}},{"order":1,"name":"Ethics","group":{"name":"EthicsHeading","label":"Declarations"}},{"value":"The authors declare there is no conflict of interest regarding the publication of this paper and we declare that we have no financial and personal relationships with other people or organizations that can inappropriately influence our work.","order":2,"name":"Ethics","group":{"name":"EthicsHeading","label":"Competing of interest"}}],"article-number":"72"}}