{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,3,31]],"date-time":"2026-03-31T14:24:38Z","timestamp":1774967078624,"version":"3.50.1"},"reference-count":60,"publisher":"MDPI AG","issue":"3","license":[{"start":{"date-parts":[[2021,3,15]],"date-time":"2021-03-15T00:00:00Z","timestamp":1615766400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Entropy"],"abstract":"<jats:p>Recently, there has been a huge rise in malware growth, which creates a significant security threat to organizations and individuals. Despite the incessant efforts of cybersecurity research to defend against malware threats, malware developers discover new ways to evade these defense techniques. Traditional static and dynamic analysis methods are ineffective in identifying new malware and pose high overhead in terms of memory and time. Typical machine learning approaches that train a classifier based on handcrafted features are also not sufficiently potent against these evasive techniques and require more efforts due to feature-engineering. Recent malware detectors indicate performance degradation due to class imbalance in malware datasets. To resolve these challenges, this work adopts a visualization-based method, where malware binaries are depicted as two-dimensional images and classified by a deep learning model. We propose an efficient malware detection system based on deep learning. The system uses a reweighted class-balanced loss function in the final classification layer of the DenseNet model to achieve significant performance improvements in classifying malware by handling imbalanced data issues. Comprehensive experiments performed on four benchmark malware datasets show that the proposed approach can detect new malware samples with higher accuracy (98.23% for the Malimg dataset, 98.46% for the BIG 2015 dataset, 98.21% for the MaleVis dataset, and 89.48% for the unseen Malicia dataset) and reduced false-positive rates when compared with conventional malware mitigation techniques while maintaining low computational time. The proposed malware detection solution is also reliable and effective against obfuscation attacks.<\/jats:p>","DOI":"10.3390\/e23030344","type":"journal-article","created":{"date-parts":[[2021,3,15]],"date-time":"2021-03-15T11:38:58Z","timestamp":1615808338000},"page":"344","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":227,"title":["An Efficient DenseNet-Based Deep Learning Model for Malware Detection"],"prefix":"10.3390","volume":"23","author":[{"given":"Jeyaprakash","family":"Hemalatha","sequence":"first","affiliation":[{"name":"Department of Computer Science and Engineering, AAA College of Engineering and Technology, Sivakasi 626123, Tamil Nadu, India"}]},{"given":"S.","family":"Roseline","sequence":"additional","affiliation":[{"name":"School of Computer Science and Engineering, Vellore Institute of Technology\u2014Chennai Campus, Vandalur\u2014Kelambakkam Road, Chennai 600127, Tamil Nadu, India"}]},{"given":"Subbiah","family":"Geetha","sequence":"additional","affiliation":[{"name":"School of Computer Science and Engineering, Vellore Institute of Technology\u2014Chennai Campus, Vandalur\u2014Kelambakkam Road, Chennai 600127, Tamil Nadu, India"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-1939-4842","authenticated-orcid":false,"given":"Seifedine","family":"Kadry","sequence":"additional","affiliation":[{"name":"Faculty of Applied Computing and Technology (FACT), Noroff University College, 4608 Kristiansand, Norway"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-9990-1084","authenticated-orcid":false,"given":"Robertas","family":"Dama\u0161evi\u010dius","sequence":"additional","affiliation":[{"name":"Faculty of Applied Mathematics, Silesian University of Technology, 44-100 Gliwice, Poland"}]}],"member":"1968","published-online":{"date-parts":[[2021,3,15]]},"reference":[{"key":"ref_1","doi-asserted-by":"crossref","first-page":"973","DOI":"10.1016\/j.jcss.2014.02.005","article-title":"A survey of emerging threats in cybersecurity","volume":"80","author":"Nepal","year":"2014","journal-title":"J. Comput. Syst. Sci."},{"key":"ref_2","doi-asserted-by":"crossref","first-page":"11","DOI":"10.1109\/MS.2018.1661316","article-title":"Recent progress in software security","volume":"35","author":"Amoroso","year":"2018","journal-title":"IEEE Softw."},{"key":"ref_3","doi-asserted-by":"crossref","unstructured":"Drew, J., Moore, T., and Hahsler, M. (2016, January 22\u201326). Polymorphic malware detection using sequence classification methods. Proceedings of the 2016 IEEE Security and Privacy Workshops (SPW), San Jose, CA, USA.","DOI":"10.1109\/SPW.2016.30"},{"key":"ref_4","doi-asserted-by":"crossref","first-page":"57","DOI":"10.1080\/19393555.2014.931487","article-title":"Metamorphic Malware Detection Using Code Metrics","volume":"23","author":"Canfora","year":"2014","journal-title":"Inf. Secur. J. A Glob. Perspect."},{"key":"ref_5","doi-asserted-by":"crossref","first-page":"41","DOI":"10.1109\/MSP.2011.98","article-title":"Obfuscation The hidden malware","volume":"9","author":"OKane","year":"2011","journal-title":"IEEE Secur. Priv."},{"key":"ref_6","first-page":"31","article-title":"Emotet Malware\u2014A Banking Credentials Stealer","volume":"22","author":"Kuraku","year":"2020","journal-title":"Iosr J. Comput. Eng."},{"key":"ref_7","doi-asserted-by":"crossref","first-page":"95","DOI":"10.20469\/ijtes.5.10004-3","article-title":"Behavioral Analysis of Trickbot Banking Trojan with its New Tricks","volume":"5","author":"Celik","year":"2019","journal-title":"Int. J. Technol. Eng. Stud."},{"key":"ref_8","doi-asserted-by":"crossref","first-page":"646","DOI":"10.1016\/j.jnca.2012.10.004","article-title":"Classification of malware based on integrated static and dynamic features","volume":"36","author":"Islam","year":"2013","journal-title":"J. Netw. Comput. Appl."},{"key":"ref_9","doi-asserted-by":"crossref","unstructured":"Subairu, S.O., Alhassan, J., Misra, S., Abayomi-Alli, O., Ahuja, R., Damasevicius, R., and Maskeliunas, R. (2020). An experimental approach to unravel effects of malware on system network interface. Lecture Notes in Electrical Engineering, Springer.","DOI":"10.1007\/978-981-15-0372-6_17"},{"key":"ref_10","doi-asserted-by":"crossref","unstructured":"Nataraj, L., Karthikeyan, S., Jacob, G., and Manjunath, B.S. (2011, January 20). Malware images. Proceedings of the 8th International Symposium on Visualization for Cyber Security\u2014VizSec 11, Pittsburgh, PA, USA.","DOI":"10.1145\/2016904.2016908"},{"key":"ref_11","unstructured":"Ronen, R., Radu, M., Feuerstein, C., Yom-Tov, E., and Ahmadi, M. (2018). Microsoft Malware Classification Challenge. arXiv."},{"key":"ref_12","doi-asserted-by":"crossref","unstructured":"Bozkir, A.S., Cankaya, A.O., and Aydos, M. (2019, January 24\u201326). Utilization and Comparison of Convolutional Neural Networks in Malware Recognition. Proceedings of the 27th Signal Processing and Communications Applications Conference (SIU), Sivas, Turkey.","DOI":"10.1109\/SIU.2019.8806511"},{"key":"ref_13","doi-asserted-by":"crossref","unstructured":"Deng, J., Dong, W., Socher, R., Li, L., Li, K., and Li, F. (2009, January 20\u201325). ImageNet: A large-scale hierarchical image database. Proceedings of the 2009 IEEE Computer Society Conference on Computer Vision and Pattern Recognition (CVPR 2009), Miami, FL, USA.","DOI":"10.1109\/CVPR.2009.5206848"},{"key":"ref_14","doi-asserted-by":"crossref","unstructured":"Huang, G., Liu, Z., Van Der Maaten, L., and Weinberger, K.Q. (2017, January 21\u201326). Densely connected convolutional networks. Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, Honolulu, HI, USA.","DOI":"10.1109\/CVPR.2017.243"},{"key":"ref_15","unstructured":"(2020, February 10). Tensorflow. Available online: www.tensorflow.org."},{"key":"ref_16","doi-asserted-by":"crossref","first-page":"15","DOI":"10.1007\/s10207-014-0248-7","article-title":"The MALICIA dataset identification and analysis of drive-by download operations","volume":"14","author":"Nappa","year":"2015","journal-title":"Int. J. Inf. Secur."},{"key":"ref_17","doi-asserted-by":"crossref","unstructured":"Souri, A., and Hosseini, R. (2018). A state-of-the-art survey of malware detection approaches using data mining techniques. Hum. Cent. Comput. Inf. Sci., 8.","DOI":"10.1186\/s13673-018-0125-x"},{"key":"ref_18","first-page":"255","article-title":"Android malware detection: A survey","volume":"Volume 942","author":"Odusami","year":"2018","journal-title":"Applied Informatics. ICAI 2018. Communications in Computer and Information Science"},{"key":"ref_19","doi-asserted-by":"crossref","first-page":"64","DOI":"10.1016\/j.ins.2011.08.020","article-title":"Opcode sequences as representation of executables for data-mining-based unknown malware detection","volume":"231","author":"Santos","year":"2013","journal-title":"Inf. Sci."},{"key":"ref_20","doi-asserted-by":"crossref","unstructured":"Tian, R., Batten, L.M., and Versteeg, S.C. (2008, January 7\u20138). Function length as a tool for malware classification. Proceedings of the 3rd International Conference on Malicious and Unwanted Software (MALWARE), Fairfax, VI, USA.","DOI":"10.1109\/MALWARE.2008.4690860"},{"key":"ref_21","doi-asserted-by":"crossref","unstructured":"Kong, D., and Yan, G. (2013, January 11\u201314). Discriminant malware distance learning on structural information for automated malware classification. Proceedings of the 19th ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, Chicago, IL, USA.","DOI":"10.1145\/2487575.2488219"},{"key":"ref_22","doi-asserted-by":"crossref","first-page":"113022","DOI":"10.1016\/j.eswa.2019.113022","article-title":"Detecting malware evolution using support vector machines","volume":"143","author":"Wadkar","year":"2020","journal-title":"Expert Syst. Appl."},{"key":"ref_23","unstructured":"Schultz, M.G., Eskin, E., Zadok, F., and Stolfo, S.J. (2001, January 14\u201316). Data mining methods for detection of new malicious executables. Proceedings of the 2001 IEEE Symposium on Security and Privacy (SP 2001), Oakland, CA, USA."},{"key":"ref_24","doi-asserted-by":"crossref","unstructured":"Roseline, S.A., and Geetha, S. (2018, January 19\u201322). Intelligent Malware Detection using Oblique Random Forest Paradigm. Proceedings of the International Conference on Advances in Computing, Communications and Informatics (ICACCI), Bangalore, India.","DOI":"10.1109\/ICACCI.2018.8554903"},{"key":"ref_25","doi-asserted-by":"crossref","first-page":"921","DOI":"10.1007\/s10586-017-1110-2","article-title":"Improvement of malware detection and classification using API call sequence alignment and visualization","volume":"22","author":"Kim","year":"2019","journal-title":"Clust. Comput."},{"key":"ref_26","doi-asserted-by":"crossref","unstructured":"Imran, M., Afzal, M.T., and Qadir, M.A. (2015, January 29\u201331). Similarity-based malware classification using hidden Markov model. Proceedings of the Fourth International Conference on Cyber Security, Cyber Warfare, and Digital Forensic (CyberSec), Jakarta, Indonesia.","DOI":"10.1109\/CyberSec.2015.33"},{"key":"ref_27","first-page":"2721","article-title":"Learning to detect and classify malicious executables in the wild","volume":"7","author":"Kolter","year":"2006","journal-title":"J. Mach. Learn. Res."},{"key":"ref_28","doi-asserted-by":"crossref","first-page":"639","DOI":"10.3233\/JCS-2010-0410","article-title":"Automatic analysis of malware behavior using machine learning","volume":"19","author":"Rieck","year":"2011","journal-title":"J. Comput. Secur."},{"key":"ref_29","unstructured":"Roseline, S.A., Hari, G., Geetha, S., and Krishnamurthy, R. (2019, January 27\u201329). Vision-Based Malware Detection and Classification Using Lightweight Deep Learning Paradigm. Proceedings of the International Conference on Computer Vision and Image Processing, Jaipur, India."},{"key":"ref_30","doi-asserted-by":"crossref","unstructured":"Roseline, S.A., Sasisri, A.D., Geetha, S., and Balasubramanian, C. (2019, January 1\u20133). Towards Efficient Malware Detection and Classification using Multilayered Random Forest Ensemble Technique. Proceedings of the 2019 International Carnahan Conference on Security Technology (ICCST), Chennai, India.","DOI":"10.1109\/CCST.2019.8888406"},{"key":"ref_31","doi-asserted-by":"crossref","unstructured":"Singh, A., Handa, A., Kumar, N., and Shukla, S.K. (2019, January 27\u201328). Malware classification using image representation. Proceedings of the International Symposium on Cyber Security Cryptography and Machine Learning, Beer Sheva, Israel.","DOI":"10.1007\/978-3-030-20951-3_6"},{"key":"ref_32","unstructured":"Shiva Darshan, S.L., and Jaidhar, C.D. (2019). Windows malware detector using convolutional neural network based on visualization images. IEEE Trans. Emerg. Top. Comput."},{"key":"ref_33","doi-asserted-by":"crossref","unstructured":"Vasan, D., Alazab, M., Wassan, S., Safaei, B., and Zheng, Q. (2020). Image-based malware classification using ensemble of CNN architectures (IMCEC). Comput. Secur., 92.","DOI":"10.1016\/j.cose.2020.101748"},{"key":"ref_34","doi-asserted-by":"crossref","unstructured":"Zhang, J., Qin, Z., Yin, H., Ou, L., Xiao, S., and Hu, Y. (2016, January 1\u20134). Malware variant detection using opcode image recognition with small training sets. Proceedings of the 25th International Conference on Computer Communication and Networks (ICCCN), Waikoloa, HI, USA.","DOI":"10.1109\/ICCCN.2016.7568542"},{"key":"ref_35","doi-asserted-by":"crossref","unstructured":"Han, K., Kang, B., and Im, E.G. (2014). Malware analysis using visualized image matrices. Sci. World J.","DOI":"10.1155\/2014\/132713"},{"key":"ref_36","doi-asserted-by":"crossref","first-page":"852","DOI":"10.1049\/cje.2018.05.001","article-title":"Automatic malware classification via PRICoLBP","volume":"27","author":"Yan","year":"2018","journal-title":"Chin. J. Electron."},{"key":"ref_37","unstructured":"Conti, G., Dean, E., Sinda, M., and Sangster, B. (2008, January 15). Visual reverse engineering of binary and data files. Proceedings of the International Workshop on Visualization for Computer Security, Cambridge, MA, USA."},{"key":"ref_38","doi-asserted-by":"crossref","unstructured":"Kancherla, K., and Mukkamala, S. (2013, January 16\u201319). Image visualization based malware detection. Proceedings of the 2013 IEEE Symposium on Computational Intelligence in Cyber Security (CICS), Singapore.","DOI":"10.1109\/CICYBS.2013.6597204"},{"key":"ref_39","doi-asserted-by":"crossref","unstructured":"Liu, L., and Wang, B. (2016, January 19\u201321). Malware classification using gray-scale images and ensemble learning. Proceedings of the 3rd International Conference on Systems and Informatics (ICSAI), Shangai, China.","DOI":"10.1109\/ICSAI.2016.7811100"},{"key":"ref_40","doi-asserted-by":"crossref","first-page":"14510","DOI":"10.1109\/ACCESS.2018.2805301","article-title":"Malware visualization for fine-grained classification","volume":"6","author":"Fu","year":"2018","journal-title":"IEEE Access"},{"key":"ref_41","doi-asserted-by":"crossref","unstructured":"Nisa, M., Shah, J.H., Kanwal, S., Raza, M., Khan, M.A., Dama\u0161evi\u010dius, R., and Bla\u017eauskas, T. (2020). Hybrid malware classification method using segmentation-based fractal texture analysis and deep convolution neural network features. Appl. Sci., 10.","DOI":"10.3390\/app10144966"},{"key":"ref_42","doi-asserted-by":"crossref","first-page":"102007","DOI":"10.1109\/ACCESS.2020.2999320","article-title":"MSIC Malware spectrogram image classification","volume":"8","author":"Azab","year":"2020","journal-title":"IEEE Access"},{"key":"ref_43","doi-asserted-by":"crossref","unstructured":"Ding, Y., Zhang, X., Hu, J., and Xu, W. (2020). Android malware detection method based on bytecode image. J. Ambient Intell. Humaniz. Comput.","DOI":"10.1007\/s12652-020-02196-4"},{"key":"ref_44","doi-asserted-by":"crossref","first-page":"14753","DOI":"10.1007\/s00521-020-04830-w","article-title":"DeNNeS Deep embedded neural network expert system for detecting cyber attacks","volume":"32","author":"Mahdavifar","year":"2020","journal-title":"Neural Comput. Appl."},{"key":"ref_45","doi-asserted-by":"crossref","unstructured":"Naeem, H., Ullah, F., Naeem, M.R., Khalid, S., Vasan, D., Jabbar, S., and Saeed, S. (2020). Malware detection in industrial internet of things based on hybrid image visualization and deep learning model. Ad Hoc Netw., 105.","DOI":"10.1016\/j.adhoc.2020.102154"},{"key":"ref_46","doi-asserted-by":"crossref","unstructured":"Singh, J., Thakur, D., Ali, F., Gera, T., and Kwak, K.S. (2020). Deep feature extraction and classification of android malware images. Sensors, 20.","DOI":"10.3390\/s20247013"},{"key":"ref_47","doi-asserted-by":"crossref","first-page":"283","DOI":"10.1109\/TDSC.2018.2884928","article-title":"Deep learning and visualization for identifying malware families","volume":"18","author":"Sun","year":"2021","journal-title":"IEEE Trans. Dependable Secur. Comput."},{"key":"ref_48","doi-asserted-by":"crossref","first-page":"436","DOI":"10.1038\/nature14539","article-title":"Deep learning","volume":"521","author":"LeCun","year":"2015","journal-title":"Nature"},{"key":"ref_49","doi-asserted-by":"crossref","first-page":"151","DOI":"10.1016\/j.eswa.2019.04.064","article-title":"A multi-level deep learning system for malware detection","volume":"133","author":"Zhong","year":"2019","journal-title":"Expert Syst. Appl."},{"key":"ref_50","doi-asserted-by":"crossref","first-page":"871","DOI":"10.1016\/j.cose.2018.04.005","article-title":"Malware identification using visualization images and deep learning","volume":"77","author":"Ni","year":"2018","journal-title":"Comput. Secur."},{"key":"ref_51","doi-asserted-by":"crossref","unstructured":"Yong, B., Wei, W., Li, K., Shen, J., Zhou, Q., Wozniak, M., Po\u0142ap, D., and Dama\u0161evi\u010dius, R. (2020). Ensemble machine learning approaches for webshell detection in internet of things environments. Trans. Emerg. Telecommun. Technol.","DOI":"10.1002\/ett.4085"},{"key":"ref_52","doi-asserted-by":"crossref","unstructured":"Azeez, N.A., Odufuwa, O.E., Misra, S., Oluranti, J., and Dama\u0161evi\u010dius, R. (2021). Windows PE Malware Detection Using Ensemble Learning. Informatics, 8.","DOI":"10.3390\/informatics8010010"},{"key":"ref_53","doi-asserted-by":"crossref","unstructured":"Dama\u0161evi\u010dius, R., Ven\u010dkauskas, A., Toldinas, J., and Grigali\u016bnas, \u0160. (2021). Ensemble-Based Classification Using Neural Networks and Machine Learning Models for Windows PE Malware Detection. Electronics, 10.","DOI":"10.3390\/electronics10040485"},{"key":"ref_54","doi-asserted-by":"crossref","first-page":"3187","DOI":"10.1109\/TII.2018.2822680","article-title":"Detection of malicious code variants based on deep learning","volume":"14","author":"Cui","year":"2018","journal-title":"IEEE Trans. Ind. Inform."},{"key":"ref_55","unstructured":"Agarap, A.F., and Pepito, F.J.H. (2017). Towards building an intelligent anti-malware system a deep learning approach using support vector machine (SVM) for malware classification. arXiv."},{"key":"ref_56","doi-asserted-by":"crossref","unstructured":"Cui, Y., Jia, M., Lin, T.Y., Song, Y., and Belongie, S. (2019, January 16\u201320). Class-balanced loss based on effective number of samples. Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, Long Beach, CA, USA.","DOI":"10.1109\/CVPR.2019.00949"},{"key":"ref_57","unstructured":"Kingma, D.P., and Ba, J. (2014). Adam: A method for stochastic optimization. arXiv."},{"key":"ref_58","doi-asserted-by":"crossref","first-page":"206303","DOI":"10.1109\/ACCESS.2020.3036491","article-title":"Intelligent Vision-based Malware Detection and Classification using Deep Random Forest Paradigm","volume":"8","author":"Roseline","year":"2020","journal-title":"IEEE Access"},{"key":"ref_59","doi-asserted-by":"crossref","first-page":"46717","DOI":"10.1109\/ACCESS.2019.2906934","article-title":"Robust intelligent malware detection using deep learning","volume":"7","author":"Vinayakumar","year":"2019","journal-title":"IEEE Access"},{"key":"ref_60","doi-asserted-by":"crossref","unstructured":"Luo, J.S., and Lo, D.C.T. (2017, January 11\u201314). Binary malware image classification using machine learning with local binary pattern. Proceedings of the IEEE International Conference on Big Data (Big Data), Boston, MA, USA.","DOI":"10.1109\/BigData.2017.8258512"}],"container-title":["Entropy"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/1099-4300\/23\/3\/344\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,11]],"date-time":"2025-10-11T05:35:49Z","timestamp":1760160949000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/1099-4300\/23\/3\/344"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2021,3,15]]},"references-count":60,"journal-issue":{"issue":"3","published-online":{"date-parts":[[2021,3]]}},"alternative-id":["e23030344"],"URL":"https:\/\/doi.org\/10.3390\/e23030344","relation":{},"ISSN":["1099-4300"],"issn-type":[{"value":"1099-4300","type":"electronic"}],"subject":[],"published":{"date-parts":[[2021,3,15]]}}}