Image-Based Malware Type Classification on MalNet-Image Tiny: Effects of Multi-Scale Fusion, Transfer Learning, Data Augmentation, and Schedule-Free Optimization

TL;DR

This study evaluates how multi-scale fusion, transfer learning, data augmentation, and schedule-free optimization improve image-based malware classification on the MalNet-Image Tiny benchmark, achieving significant performance gains.

Contribution

It demonstrates the effectiveness of combining pretraining, augmentation, FPN, and schedule-free optimization for malware image classification, with detailed ablation analysis.

Findings

Pretraining and augmentation yield the largest improvements in F1_macro.

FPN mainly enhances precision, AUC, and loss metrics.

The best configuration achieves F1_macro=0.6927 with ResNet18.

Abstract

This paper studies 43-class malware type classification on MalNet-Image Tiny, a public benchmark derived from Android APK files. The goal is to assess whether a compact image classifier benefits from four components evaluated in a controlled ablation: a feature pyramid network (FPN) for scale variation induced by resizing binaries of different lengths, ImageNet pretraining, lightweight augmentation through Mixup and TrivialAugment, and schedule-free AdamW optimization. All experiments use a ResNet18 backbone and the provided train/validation/test split. Reproducing the benchmark-style configuration yields macro-F1 (F1_macro) of 0.6510, consistent with the reported baseline of approximately 0.65. Replacing the optimizer with schedule-free AdamW and using unweighted cross-entropy increases F1_macro to 0.6535 in 10 epochs, compared with 96 epochs for the reproduced baseline. The best configuration combines pretraining, Mixup, TrivialAugment, and FPN, reaching F1_macro=0.6927, P_macro=0.7707, AUC_macro=0.9556, and L_test=0.8536. The ablation indicates that the largest gains in F1_macro arise from pretraining and augmentation, whereas FPN mainly improves P_macro, AUC_macro, and L_test in the strongest configuration.