A Deep Learning-Driven Image Transformation Approach for Android Malware Detection using CNN and Transfer Learning Techniques

Malware detection in Android applications remains a critical challenge due to the increasing sophistication of cyber threats. This paper explores a novel approach for Android malware classification by transforming APK files into grayscale images and applying deep learning techniques. Two distinct image datasets were created: The Whole APK Image Dataset, where the entire APK file is converted into an image, and the DEX Image Dataset, which uses only the Dalvik Executable (DEX) file. A dataset of 2000 Android applications was collected, consisting of 1000 malware samples from VirusShare and 1000 benign applications from the Google Play Store and APKPure. Three deep learning models—CNN, VGG19, and ResNet50—were trained and evaluated on both datasets to assess classification performance. Experimental results indicate that the DEX Image Dataset consistently outperforms the Whole APK Image Dataset, achieving higher accuracy across all models. Among the tested architectures, CNN achieved the highest accuracy of 90% on the DEX dataset, surpassing both VGG19 and ResNet50. These findings emphasize that focusing on the DEX portion of Android applications, which contains the executable code, enhances malware detection accuracy.