Hybrid Feature Image Mapping (HFIM): A Multi-Channel Image Approach for Malware Detection Using Static and Dynamic Features

Abstract

Image-based malware detection has emerged as an alternative to high-dimensional handcrafted feature representations; however, most existing approaches rely primarily on static features or encode multiple features from a single analysis domain, which may limit robustness under code obfuscation and incomplete feature extraction. This paper proposes Hybrid Feature Image Mapping (HFIM), a multi-channel malware visualization technique that integrates structural (binary content), semantic (opcode transitions), and behavioral (API activity) information into a unified RGB representation. HFIM is designed as a representation-level approach that encodes complementary static and dynamic characteristics within a single image, allowing convolutional neural networks (CNNs) to exploit complementary cross-domain patterns while maintaining classification performance when certain feature streams are partially unavailable. HFIM is evaluated against three representative malware imaging methods, HIT4Mal, MC-ISA, and MTV, using seven CNN architectures under identical training conditions to ensure fair comparison and isolate the impact of feature representation. Experimental results based on 10-fold cross-validation demonstrate consistent improvements across multiple evaluation metrics, including accuracy, precision, recall, and F1-score. Additional analyses, including ablation and family-aware evaluation, further indicate that multi-domain integration provides a more discriminative and stable representation than single-domain approaches, particularly under variations in feature availability. These results indicate that integrating static and dynamic features at the representation level can improve robustness and classification performance in image-based malware detection.