Malware API Cnn Eval

malware-api-cnn-eval

Dynamic Malware Classification of Windows PE Files using CNNs and Greyscale Images Derived from Runtime API Call Argument Conversion — Shahnawaz et al. (2025) (arXiv:2505.24231, 2025)

What this evaluates

Evaluates a CNN's ability to classify Windows PE files as malware or benign by learning spatial features from grayscale images generated from dynamic API call argument sequences. It probes the model's resilience to obfuscation by leveraging behavioral temporal patterns converted into visual representations.

Datasets

• Windows PE Malware Dataset — total 22056; splits: train (17544), test (4512); repo https://github.com/md-shahnawaz-cse/DMC-MAL-CNN

Metrics

• accuracy (primary) — range: [0, 1]
  • Standard classification accuracy: the proportion of correctly classified samples out of the total test set. Calculated as (number of correct predictions) / (total number of predictions).

Input / output format

Input: Grayscale images generated by converting runtime API call argument sequences into visual data using a magma colormap, fed into a Convolutional Neural Network.

Output: Discrete class label indicating the software type (Adware, Backdoor, Downloader, Spyware, Trojan, Virus, Worms, or Benign).

Scoring recipe

def calculate_accuracy(predictions, gold_labels):
    correct = sum(1 for p, g in zip(predictions, gold_labels) if p == g)
    return correct / len(gold_labels)

Common pitfalls

• The dataset is sourced from reference [18] and not directly linked in the experimental setup, making exact sample replication difficult without consulting the citation.
• The conversion pipeline from API sequences to grayscale images (colormap, sequence length, image dimensions) is not detailed in this section, risking inconsistent input generation.
• The train/test split is fixed (17,544/4,512) without mention of random shuffling or stratification, which may introduce class imbalance effects during evaluation.

Evidence (verbatim from paper)

enabling the CNN to extract spatially discriminative features for high-accuracy (98.36%) malware vs. benign detection, with resilience against obfuscation and evasion tactics by leveraging visual feature learning from behavioral sequences.

Citation

@misc{shahnawaz2025dynamic,
  title={Dynamic Malware Classification of Windows PE Files using CNNs and Greyscale Images Derived from Runtime API Call Argument Conversion},
  author={Shahnawaz et al. (2025)},
  year={2025},
  note={arXiv:2505.24231}
}

• arXiv: 2505.24231