{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,4,2]],"date-time":"2026-04-02T18:08:22Z","timestamp":1775153302512,"version":"3.50.1"},"reference-count":19,"publisher":"MDPI AG","issue":"3","license":[{"start":{"date-parts":[[2021,3,11]],"date-time":"2021-03-11T00:00:00Z","timestamp":1615420800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Information"],"abstract":"<jats:p>Malware creators generate new malicious software samples by making minor changes in previously generated code, in order to reuse malicious code, as well as to go unnoticed from signature-based antivirus software. As a result, various families of variations of the same initial code exist today. Visualization of compiled executables for malware analysis has been proposed several years ago. Visualization can greatly assist malware classification and requires neither disassembly nor code execution. Moreover, new variations of known malware families are instantly detected, in contrast to traditional signature-based antivirus software. This paper addresses the problem of identifying variations of existing malware visualized as images. A new malware detection system based on a two-level Artificial Neural Network (ANN) is proposed. The classification is based on file and image features. The proposed system is tested on the \u2018Malimg\u2019 dataset consisting of the visual representation of well-known malware families. From this set some important image features are extracted. Based on these features, the ANN is trained. Then, this ANN is used to detect and classify other samples of the dataset. Malware families creating a confusion are classified by a second level of ANNs. The proposed two-level ANN method excels in simplicity, accuracy, and speed; it is easy to implement and fast to run, thus it can be applied to antivirus software, smart firewalls, web applications, etc.<\/jats:p>","DOI":"10.3390\/info12030118","type":"journal-article","created":{"date-parts":[[2021,3,11]],"date-time":"2021-03-11T04:46:53Z","timestamp":1615438013000},"page":"118","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":26,"title":["Malware Detection Based on Code Visualization and Two-Level Classification"],"prefix":"10.3390","volume":"12","author":[{"ORCID":"https:\/\/orcid.org\/0000-0003-3614-0294","authenticated-orcid":false,"given":"Vassilios","family":"Moussas","sequence":"first","affiliation":[{"name":"School of Engineering, University of West Attica, Aigaleo, Attica 12210, Greece"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-2271-8764","authenticated-orcid":false,"given":"Antonios","family":"Andreatos","sequence":"additional","affiliation":[{"name":"Division of Computer Engineering and Information Science, Hellenic Air Force Academy, Dekeleia, Attica 13671, Greece"}]}],"member":"1968","published-online":{"date-parts":[[2021,3,11]]},"reference":[{"key":"ref_1","doi-asserted-by":"crossref","unstructured":"Nataraj, L., Karthikeyan, S., Jacob, G., and Manjunath, B.S. (2011, January 20). Malware images: Visualization and automatic classification. Proceedings of the 8th International Symposium on Visualization for Cyber Security, Pittsburgh, PA, USA.","DOI":"10.1145\/2016904.2016908"},{"key":"ref_2","unstructured":"(2020, December 23). McAfee Labs Threats Reports. November 2020. Available online: https:\/\/www.mcafee.com\/enterprise\/en-us\/threat-center\/mcafee-labs\/reports.html."},{"key":"ref_3","unstructured":"Mallet, H. (2020, July 18). Malware Classification Using Convolutional Neural Networks\u2014Step by Step Tutorial. A Quick and Easy Tutorial about an Interesting Approach to Malware Classification. 27 May 2020. Available online: https:\/\/towardsdatascience.com\/malware-classification-using-convolutional-neural-networks-step-by-step-tutorial-a3e8d97122f."},{"key":"ref_4","unstructured":"Donahue, J., Paturi, A., and Mukkamala, S. (2020, December 28). Visualization Techniques for Efficient Malware Detection. RiskSense Technical White Paper Series. Available online: https:\/\/www.risksense.com\/wp-content\/uploads\/2018\/05\/Visualization-Techniques-for-Efficient-Malware-Detection.pdf."},{"key":"ref_5","doi-asserted-by":"crossref","first-page":"107138","DOI":"10.1016\/j.comnet.2020.107138","article-title":"IMCFN: Image-based malware classification using fine-tuned convolutional neural network architecture","volume":"171","author":"Vasan","year":"2020","journal-title":"Comput. Netw."},{"key":"ref_6","doi-asserted-by":"crossref","unstructured":"Narayanan, B.N., and Davuluru, V.S.P. (2020). Ensemble Malware Classification System using Deep Neural Networks. Electronics, 9.","DOI":"10.3390\/electronics9050721"},{"key":"ref_7","unstructured":"Conti, G., Dean, E., Sinda, M., and Sangster, B. (2018). Visual reverse engineering of binary and data files. Lecture Notes in Computer Science, Proceedings of the 5th International Workshop on Visualization for Computer Security, VizSec \u201908, Cambridge, MA, USA, 15 September 2008, Springer."},{"key":"ref_8","doi-asserted-by":"crossref","unstructured":"Quist, D.A., and Liebrock, L.M. (2009, January 11). Visualizing compiled executables for malware analysis. Proceedings of the 6th International Workshop on Visualization for Cyber Security (VizSec), Atlantic City, NJ, USA.","DOI":"10.1109\/VIZSEC.2009.5375539"},{"key":"ref_9","unstructured":"Conti, G., Bratus, S., Shubina, A., Lichtenberg, A., Ragsdale, R., Perez-Alemany, R., Sangster, B., and Supan, M.A. (2010). Visual Study of Binary Fragment Types, Black Hat."},{"key":"ref_10","doi-asserted-by":"crossref","first-page":"145","DOI":"10.1023\/A:1011139631724","article-title":"Modeling the shape of a scene: A holistic representation of the spatial envelope","volume":"42","author":"Oliva","year":"2001","journal-title":"Int. J. Comput. Vis."},{"key":"ref_11","doi-asserted-by":"crossref","unstructured":"Kancherla, K.S., and Mukkamala, S. (2013, January 16\u201319). Image visualization based malware detection. Proceedings of the 2013 IEEE Symposium on Computational Intelligence in Cyber Security (CICS), Singapore.","DOI":"10.1109\/CICYBS.2013.6597204"},{"key":"ref_12","doi-asserted-by":"crossref","unstructured":"Narayanan, B.N., Djaneye-Boundjou, O., and Kebede, T.M. (2016, January 25\u201329). Performance analysis of machine learning and pattern recognition algorithms for malware classification. Proceedings of the 2016 IEEE National Aerospace and Electronics Conference (NAECON) and Ohio Innovation Summit (OIS), Dayton, OH, USA.","DOI":"10.1109\/NAECON.2016.7856826"},{"key":"ref_13","doi-asserted-by":"crossref","unstructured":"Makandar, A., and Patrot, A. (2015, January 21\u201322). Malware Analysis and Classification using Artificial Neural Network. Proceedings of the 2015 International Conference on Trends in Automation, Communications and Computing Technology (I-TACT-15), Bangalore, India.","DOI":"10.1109\/ITACT.2015.7492653"},{"key":"ref_14","unstructured":"Yue, S. (2020, December 30). Imbalanced Malware Images Classification: A CNN based Approach. Submitted on 27 August 2017. Available online: https:\/\/arxiv.org\/abs\/1708.08042."},{"key":"ref_15","doi-asserted-by":"crossref","first-page":"3187","DOI":"10.1109\/TII.2018.2822680","article-title":"Detection of Malicious Code Variants Based on Deep Learning","volume":"14","author":"Cui","year":"2018","journal-title":"J. IEEE Trans. Ind. Inform."},{"key":"ref_16","doi-asserted-by":"crossref","first-page":"50","DOI":"10.1016\/j.jpdc.2019.03.010","article-title":"Malicious code detection based on CNNs and multi-objective algorithm","volume":"129","author":"Cui","year":"2019","journal-title":"J. Parallel Distrib. Comput."},{"key":"ref_17","doi-asserted-by":"crossref","first-page":"871","DOI":"10.1016\/j.cose.2018.04.005","article-title":"Malware identification using visualization images and deep learning","volume":"77","author":"Ni","year":"2018","journal-title":"Comput. Secur."},{"key":"ref_18","doi-asserted-by":"crossref","unstructured":"Yajamanam, S., Selvin, V.R.S., Di Troia, F., and Stamp, M. (2018, January 22\u201324). Deep Learning versus Gist Descriptors for Image-based Malware Classification. Proceedings of the 4th International Conference on Information Systems Security and Privacy (ICISSP 2018), Funchal, Portugal.","DOI":"10.5220\/0006685805530561"},{"key":"ref_19","doi-asserted-by":"crossref","unstructured":"Makandar, A., and Patrot, A. (2017, January 24\u201326). Malware class recognition using image processing techniques. Proceedings of the 2017 International Conference on Data Management, Analytics and Innovation (ICDMAI), Pune, India.","DOI":"10.1109\/ICDMAI.2017.8073489"}],"container-title":["Information"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/2078-2489\/12\/3\/118\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,11]],"date-time":"2025-10-11T05:33:52Z","timestamp":1760160832000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/2078-2489\/12\/3\/118"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2021,3,11]]},"references-count":19,"journal-issue":{"issue":"3","published-online":{"date-parts":[[2021,3]]}},"alternative-id":["info12030118"],"URL":"https:\/\/doi.org\/10.3390\/info12030118","relation":{},"ISSN":["2078-2489"],"issn-type":[{"value":"2078-2489","type":"electronic"}],"subject":[],"published":{"date-parts":[[2021,3,11]]}}}