Attention-Enhanced CNN for Malware Image Classification with Explainable AI

Abstract

Malware classification is an essential cybersecurity task for detecting and mitigating harmful software threats. One kind of current deep learning method that has shown promising results in the classification of malware photos is convolutional neural networks (CNNs). Major challenges that remain include a lack of model interpretability, poor performance on minority malware families, and class imbalance. In this work, we propose an attention-enhanced CNN architecture for multi-class malware classification using image representations from the Malimg dataset. A Squeeze-and-Excitation (SE) attention module is added to the baseline architecture, which is a pre-trained ResNet18 model, to enhance feature representation by channel-wise recalibration. The model is compared with 25 distinct virus families using a standard CNN baseline. Experimental results show that the proposed attention-based model obtains a macro F1-score of 0.98 and an accuracy of 99.37%, demonstrating significant increases, particularly in minority class classification where baseline techniques often perform normally. Grad-CAM is also used to address the black-box nature of deep learning models by providing visual explanations of model predictions. A comparison of Grad-CAM visualizations shows that the attention-enhanced model does a better job of focusing on the most important parts of malware images than the baseline CNN. The suggested method is a dependable and straightforward way to find malware in the real world because it makes it easier to understand and works better at classifying things.