A Malware Classification Method Based on Knowledge Distillation and Feature Fusion

TAs the number of web users continues to increase, the frequency of malicious attacks carried out by malware is also on the rise. The emergence of many new malware variants has resulted in relatively poor detection accuracy using traditional methods. To address issues such as poor accuracy and the inability to effectively handle malware obfuscation, this paper proposes a malware classification method based on improved ResNet50 and improved VGG16 feature fusion (MC-KDFF). This approach incorporates image texture features with enhanced Local Binary Pattern (LBP), providing insights into the local structure and layout of images and aiding the model in better understanding image details and internal structure, thus enhancing classification performance. In the feature extraction phase using improved ResNet50 and improved VGG16, asymmetric convolution is used and triple attention mechanism is used to improve the feature extraction in the center cross position part, capturing the importance of cross dimensional features in the tensor. In the classification phase, an attention mechanism (global attention block) is added to better extract features and improve model robustness.MCF-RV also uses knowledge distillation with vit (Vision Transformer) as a faculty modeler, which can effectively optimize and improve the performance of large models. The approach was evaluated using the Malimg malware image dataset, achieving an accuracy rate of 99.50%. Similarly, experiments conducted on the Microsoft BIG 2015 dataset yielded an accuracy rate of 97.52%.