Deep Learning in Cybersecurity: A Hybrid CNN Framework for Multi-Source Malware Detection

The paper introduces a new method for improving the detection of malware using Convolutional Neural Networks (CNN). The method uses a hybrid architecture for CNN that combines Xception and ResNet50 models for image-based and feature-based collections-based malware detection and classification. Unlike existing methods, the method contains a combined feature-to-image conversion workflow accommodating lossless learning under varying formats for the data so that the model can process static attributes and grayscale images under the same umbrella. The combination resolves issues such as shifting attack patterns, imbalanced classes, and variability in the representation of the data that make the process of detection problematic. The architecture for the CNN gains the appropriate features automatically for the input malware and translates it into interpretable representations, which facilitate the accuracy of the detection to be markedly improved. The CNN architecture was experimented on two benchmark collections, the Malimg dataset ($\mathbf{9, 3 3 9}$ malware images) and the Drebin dataset ($\mathbf{1 5, 0 3 6}$ Android programs). The method achieves a result of 99 % accuracy for the classification of the malware families (Malimg) and detects the Android malware with a level of accuracy that stands at 98% (Drebin). Cross-validation confirms stable performance ($99.4 \% \pm 0.10 {\%}$) across the board. The conclusion confirms the effectiveness and high computational performance for the architecture and opens the possibilities for developing autonomous real-time malware tools for IoT platforms, smartphones, and networked platforms.