REVIEW 4 major objections 6 minor 1 cited by
Dynamic Malware Classification of Windows PE Files using CNNs and Greyscale Images Derived from Runtime API Call Argument Conversion
T0 review · 4 major / 6 minor · reviewed 2026-08-07 · deepseek-v4-flash
Pith's one-line read A CNN trained on grayscale images of runtime API call arguments classifies Windows PE malware into seven families plus benign with 98.36% average accuracy, and the paper claims this behavioral representation withstands common evasion…
desk verdict The reported 98.36% accuracy is not credible from the paper's own numbers, but the dynamic API-argument-to-image pipeline and the released dataset are worth a second look after a careful revision. read the letter →
The pith
A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.
The reading
What carries the argument
The central object is the API-call-argument unigram image: each sample's behavioral report is reduced to a frequency vector of unigrams such as API name plus argument string, normalized, and reshaped into a 128x128 pixel map. The resulting grayscale image, later recolored with a magma map, encodes which system interactions occurred and how often, allowing the CNN's convolutional filters to learn spatial patterns that stand in for behavior. The compact CNN with three convolution-pool blocks, a dropout dense layer, and an 8-way softmax carries out the classification.
What would settle it
Run the trained model on a fresh set of malware whose labels are independently established, while re-running each sample twice in the sandbox to measure log stability; if accuracy collapses on samples that detect the sandbox, or if repeat runs give different images for the same file, the claimed resilience and accuracy would not hold outside the original dataset.
Extended reading notes
Core claim
The paper's central claim is that dynamic API call arguments, converted into images, are discriminative enough for a generic CNN to classify malware families with high accuracy and robustness. The authors' pipeline executes each Windows PE sample in a sandbox, records the behavioral report, splits it into API category, name, argument, and return, and builds unigrams of the form API name plus argument. After normalization to 0–255 and reshaping into 128x128 matrices, the images are enhanced with Gaussian blur, CLAHE, and Sobel edge detection, recolored with a magma colormap, and fed to a three-convolutional-layer CNN with dropout and softmax over eight classes. The reported evaluation uses 22,056 samples (17,544 train, 4,512 test) and yields 98.36% average accuracy; the confusion matrix shows clean separation for downloader and benign samples, with most confusion in adware, backdoor, and worm classes. The authors conclude that behavior-derived images capture both structural and temporal features, making the method suitable for evasive malware that static analysis misses.
Load-bearing premise
The whole result depends on the sandbox logs being a faithful picture of what each sample really does and on the seven family labels in the dataset being correct and non-overlapping; if a sample evades the sandbox or is mislabeled, the 98.36% number does not reflect real-world classification skill.
Editorial extensions
If this is right
- A detector built on runtime behavior can in principle catch polymorphic and metamorphic variants that keep their actions while changing their code.
- The API-call-argument unigrams carry enough information that a generic CNN separates eight classes from images alone, without manually engineered signatures.
- The 128x128 image format and the small three-convolution network keep training feasible on ordinary GPU hardware, supporting deployment in settings with limited compute.
- The reported confusion pattern implies that downloaders and benign files are nearly perfectly separated, while most mistakes concentrate in adware, backdoor, and worm classes.
Reading between the lines
- The paper leaves implicit that the same encoding should be tested against API-name-only images; dropping the argument component would reveal whether the accuracy gain comes from arguments or merely from call names.
- A direct check of the evasion claim would run the model on samples known to detect sandboxes or that change their API behavior across executions; the reported results do not include such a test.
- Because the image representation is agnostic to the operating system, the pipeline could be lifted to Android or Linux by substituting system-call logs for Windows API calls.
Editorial analysis
A structured set of objections, weighed in public.
Referee Report
Summary. The paper proposes a malware classification pipeline for Windows PE files that runs samples in Cuckoo Sandbox, extracts API call names and arguments as unigram features, normalizes and reshapes each sample's feature vector into a 128x128 image, applies enhancement and a magma colormap, and trains a CNN to classify the images into seven malware families plus benign. The authors report an average accuracy of 98.36% and claim resilience against typical evasion strategies. The dataset is a new, self-created corpus of 22,056 samples (reference [18]). The core empirical claim rests on Tables I-III and Figure 4, but the evaluation tables are internally inconsistent with the stated test split, which is the central problem with the manuscript.
Significance. If the reported accuracy were reliably established, the work would be a useful example of integrating dynamic behavioral analysis with CNN-based image classification, with a relatively large self-collected dataset and a simple, reproducible pipeline. The authors provide a dataset DOI [18], which supports reproducibility. However, the main numerical claim is not currently supported: the confusion matrix in Table III cannot be reconciled with the test split in Table I, and no explanation is offered. In addition, the advertised resilience to evasion is asserted but never experimentally tested. The underlying idea is not new (API-sequence-to-image CNN classification has appeared before), but the specific encoding and dataset could still be of interest if the evaluation were sound.
major comments (4)
- [Section VI, Tables I and III] The confusion matrix row sums in Table III are inconsistent with the test set sizes in Table I. For each class, TP+FN equals the true number of test samples from that class, but Table III gives Adware 312+85=397 versus 316 in Table I, Backdoor 114+21=135 versus 228, Spyware 160+29=189 versus 167, Trojan 641+73=714 versus 675, Virus 446+33=479 versus 464, Worm 247+24=271 versus 305, and Benign 1704+23=1727 versus 1857; only Downloader matches. The row totals sum to 4412, not the stated 4512 test samples. The per-class accuracies in Table II (e.g., Adware (312+4011)/4412=98.0%, Trojan (641+3664)/4412=97.6%) are exactly what one computes from Table III with the 4412 denominator, so the headline 98.36% accuracy inherits this mismatch. The paper provides no explanation for the missing 100 samples or the per-class discrepancies. As a result, the central claim of effective classification at 98.36% accuracy is not supported by the manuscript's own evaluation tables and must be corrected or thoroughly explained.
- [Abstract and Section VI] The abstract claims the method 'demonstrates significant resilience against typical evasion strategies,' but the paper contains no experiment that tests evasion, adversarial perturbations, obfuscation, or concept drift. The only related statements are qualitative remarks in the introduction and conclusion. Since this is a load-bearing part of the abstract's claim, the authors should either remove the claim or add a concrete evaluation (e.g., classifying packed/obfuscated samples, or applying adversarial perturbations to the images).
- [Section IV, Phase 2 and Table I] The ground-truth labels of the dataset (reference [18]) are load-bearing for every reported metric, but the paper does not describe how the labels were obtained, validated, or deduplicated. The samples come from VirusShare/VirusTotal, yet the classification target (e.g., 'Backdoor' vs 'Trojan') depends on the labels assigned in the authors' Kaggle dataset. The paper should describe the labeling procedure, the number of antivirus engines or other sources used, and any quality controls. Without this, the 98.36% figure could reflect label noise or label leakage rather than behavior learned from API calls.
- [Section IV, Phase 4 (Feature Transformation)] The transformation from the unigram feature vector to a 128x128 image is central to the method, but the paper does not justify why a row-major reshape places semantically related features near each other. Equation (2) defines I(x,y)=f(X) without specifying f, and the text simply states that CNNs 'find underlying spatial patterns.' In the absence of a meaningful spatial arrangement, the CNN's translation-invariance and local connectivity may actually harm performance compared to a plain MLP. The authors should at least discuss this assumption and, ideally, compare against a non-image baseline (e.g., a fully connected network on the same feature vector) to show that the image representation contributes positively.
minor comments (6)
- [Title and Abstract] The title and abstract repeatedly call the images 'grayscale,' but the method applies a magma colormap, which is a color map. This is contradictory; clarify whether the final images fed to the CNN are single-channel grayscale or three-channel RGB after colormapping.
- [Section III] In the discussion of Sasikala and Shanmuganathan [5], the sentence 'This method reached 10% level of accuracy' is confusing; it likely should read '100%' or a specific figure. Please correct and ensure the description matches the cited work.
- [Table IV] For the proposed work, the 'Detection' column is marked '✗', which contradicts the paper's claim of detecting malware. Also, the dataset is listed as VirusShare [16] while Section V states the experiments use the authors' Kaggle dataset [18]. Make Table IV consistent with the main text.
- [Section IV, Phase 1] The unigram feature construction is described only in high-level terms ('API name is the first part and the API call argumant is added using underscores'). Please report the total vocabulary size, the frequency threshold (if any), and how the numeric values in the CSV were derived (counts? TF-IDF? binary indicators?).
- [Section V / Footnote 3] The footnote 'Code and Dataset' promises code availability, but no URL is given. For reproducibility, provide a link to the code repository and the exact version of the dataset used.
- [Section II, 'Experimental Conversion of Features into Image'] This subsection appears in Basic Concepts yet describes the paper's own pipeline; it would fit better in Section IV. Also, the sentence 'The mapping of features to their images is IMAGE[EXEMPLAR][DENSITY][LIGHT][ANGLE]' is opaque and should be removed or rephrased.
Circularity Check
No circularity: the CNN is trained on one split and evaluated on a held-out test split, with no fitted parameter renamed as a prediction; self-cited prior work and the self-published dataset are contextual or source data, not premises that force the conclusion.
full rationale
The paper's derivation chain is an empirical pipeline: Cuckoo Sandbox behavioral reports (Section IV Phase 1) are reduced to API-name/argument unigrams, converted to normalized 128x128 images, and fed to a three-convolution-layer CNN trained on 17,544 samples and evaluated on a held-out 4,512-sample test split (Section V, Table I). The test set is not used for training or for setting any hyperparameter, so the reported accuracy is an out-of-sample measurement rather than a fitted input renamed as a prediction. No equation defines the target claim in terms of its own inputs: Equation (1) is the standard convolution definition and Equation (2) is a generic statement that a feature vector is mapped to an image grid; neither embeds the classification result. The self-authored references ([13], [14], [15]) are related-work descriptions and do not supply any load-bearing premise, and the self-published dataset ([18]) is the data source whose labels come from external repositories (VirusShare/VirusTotal), not from the model output, so the evaluation is externally falsifiable rather than definitionally forced. Two flagged weaknesses are correctness issues rather than circularity: (a) Table III row sums total 4,412 while Table I states a 4,512 test split (per-class counts also differ, e.g., Adware 397 vs 316), so the headline 98.36% - the unweighted average of Table II per-class accuracies - is not reproducible from the stated test set; note also that this class-balanced average is not the overall accuracy (4,124 of 4,412 is about 93.5%), a transparency issue; and (b) the abstract's claim of 'significant resilience against typical evasion strategies' has no corresponding experiment in the paper. Neither issue involves a derivation that reduces to its own inputs.
Assumptions & free parameters
free parameters (4)
- Image size =
128x128
- CNN hyperparameters =
32/64/128 filters, kernel 3, dense 256, dropout 0.5, 100 epochs
- Unigram feature count =
not stated
- Train/test split ratio =
17544/4512 (about 80/20)
assumptions (4)
- domain assumption Cuckoo Sandbox reports accurately capture the true runtime behavior of each PE sample.
- domain assumption Labels from VirusShare/VirusTotal and the authors' Kaggle dataset are correct and class-disjoint.
- ad hoc to paper Flattening the feature vector into a row-major 128x128 grid places related features near each other so that spatial convolutions are meaningful.
- domain assumption API name plus argument unigrams are stable, discriminative behavioral features.
Cite this review
Pith. "Pith review of Dynamic Malware Classification of Windows PE Files using CNNs and Greyscale Images Derived from Runtime API Call Argument Conversion." pith.science (2026). https://pith.science/paper/6LGQNIC5
@misc{pith2026250524231,
author = {Pith},
title = {Pith review of: Dynamic Malware Classification of Windows PE Files using CNNs and Greyscale Images Derived from Runtime API Call Argument Conversion},
year = {2026},
howpublished = {\url{https://pith.science/paper/6LGQNIC5}},
note = {Machine review of arXiv:2505.24231}
}
read the original abstract
Malware detection and classification remains a topic of concern for cybersecurity, since it is becoming common for attackers to use advanced obfuscation on their malware to stay undetected. Conventional static analysis is not effective against polymorphic and metamorphic malware as these change their appearance without modifying their behavior, thus defying the analysis by code structure alone. This makes it important to use dynamic detection that monitors malware behavior at runtime. In this paper, we present a dynamic malware categorization framework that extracts API argument calls at the runtime execution of Windows Portable Executable (PE) files. Extracting and encoding the dynamic features of API names, argument return values, and other relative features, we convert raw behavioral data to temporal patterns. To enhance feature portrayal, the generated patterns are subsequently converted into grayscale pictures using a magma colormap. These improved photos are used to teach a Convolutional Neural Network (CNN) model discriminative features, which allows for reliable and accurate malware classification. Results from experiments indicate that our method, with an average accuracy of 98.36% is effective in classifying different classes of malware and benign by integrating dynamic analysis and deep learning. It not only achieves high classification accuracy but also demonstrates significant resilience against typical evasion strategies.
Figures
Figures from the paper (3 more)
Forward citations
Cited by 1 Pith paper
-
System Calls for Malware Detection and Classification: Methodologies and Applications
A survey of system call and API call based malware detection that consolidates known methodologies and repeats the authors' previously published accuracy results.
Reference graph
Works this paper leans on
-
[18]
Kishore, Pushkar, Swadhin Kumar Barisal, and Durga Prasad Mohapatra. ”Family Classification of Malicious Applications using Hybrid Analysis and Computationally Economical Machine Learning Techniques. ” In 2022 IEEE/WIC/ACM International Joint Conference on Web In- telligence and Intelligent Agent Technology (WI-IAT) , pp. 442–449. IEEE, 2022. [Online]. Av...
-
[13]
”A Deep Learning Framework for Malware Classification using NLP Techniques
Gond, Bishwajit Prasad, Atul Kumar Singh, and Durga Prasad Mohapa- tra. ”A Deep Learning Framework for Malware Classification using NLP Techniques. ”In 2024 15th International Conference on Computing Communication and Networking Technologies (ICCCNT) , pp. 1–8. IEEE, 2024. [Online]. Available: https://doi.org/10.1109/ICCCNT61001. 2024.10725427
-
[14]
Rajneekant, Pushkar Kishore, Bishwajit Prasad Gond, and Durga Prasad Mohapatra. ”Enhancing Malware Classification with Machine Learning: A Comparative Analysis of API Sequence-Based Techniques. ” In 2024 IEEE International Conference on Smart Power Control and Re- newable Energy (ICSPCRE), pp. 1–6. IEEE, 2024. [Online]. Available: https://doi.org/10.1109/...
arXiv 2024
-
[1]
Global Cybersecurity Outlook 2025
World Economic Forum. Global Cybersecurity Outlook 2025. 2025. [Online]. Available: https://reports.weforum.org/docs/WEF Global Cybersecurity Outlook 2025.pdf [Accessed: 2025-04-13]
work page 2025
-
[2]
”CNN-Based Malware Family Classification and Evaluation
Hebish, Mohamed Wael, and Mohamed Awni. ”CNN-Based Malware Family Classification and Evaluation. ” In 2024 14th International Conference on Electrical Engineering (ICEENG), pp. 219–224. IEEE,
work page 2024
-
[3]
Javed, Sheikh Muhammad Zeeshan, and Muhammad Faisal Amjad. ”Enhancing Malware Classification Through Dynamic Behavioral Anal- ysis, SIEM Integration, and Deep Learning. ” In 2024 International Seminar on Intelligent Technology and Its Applications (ISITIA) , pp. 663–668. IEEE, 2024. [Online]. Available: https://doi.org/10.1109/ ISITIA63062.2024.10667741
-
[4]
Peng, Derek, Mohammed Husain, Abdullah Siddiqui, and Srijit Bhat- tacharya. ”Visual Malware Classification Using a CNN.” In 2024 IEEE MIT Undergraduate Research Technology Conference (URTC) , pp. 1–5. IEEE, 2024. [Online]. Available: https://doi.org/10.1109/ URTC65039.2024.10937559
-
[5]
Sasikala, L., and C. Shanmuganathan. ”Effective Malware Classification using Fine-tuned CNN Architecture: An Image-Based Approach. ” In 2024 2nd International Conference on Networking and Commu- nications (ICNWC) , pp. 1–6. IEEE, 2024. [Online]. Available: https: //doi.org/10.1109/ICNWC60771.2024.10537444
arXiv 2024
Show all 21 references
-
[6]
Musaev, Akobir, Abdulaziz Anorboev, and Jonghee M. Youn. ”Opti- mized Epoch Selection Ensemble: Integrating Custom CNN and Fine- Tuned MobileNetV2 for Malimg Dataset Classification. ” IEEE Access, vol. 13, pp. 45623–45633, 2025. [Online]. Available: https://doi.org/10. 1109/AC...
2025
-
[7]
”MVC-RSN: A Malware Classification Method With Variant Identification Ability
Wu, Wei, Haipeng Peng, Haotian Zhu, and Lixiang Li. ”MVC-RSN: A Malware Classification Method With Variant Identification Ability. ” IEEE Internet of Things Journal , vol. 11, no. 21, pp. 35654–35668,
-
[8]
”IoT Malware Classification Based on Lightweight Convolutional Neural Net- works
Yuan, Baoguo, Junfeng Wang, Peng Wu, and Xianguo Qing. ”IoT Malware Classification Based on Lightweight Convolutional Neural Net- works. ”IEEE Internet of Things Journal, vol. 9, no. 5, pp. 3770–3783,
-
[9]
Available: https://doi.org/10.1109/JIOT.2024.3436903
[Online]. Available: https://doi.org/10.1109/JIOT.2024.3436903
2024
-
[10]
” Mal Class: A Deep Learning Approach for Automatic Classi- fication of Malware Images.” In 2025 4th International Conference on Sentiment Analysis and Deep Learning (ICSADL) , pp
S, Divya. ” Mal Class: A Deep Learning Approach for Automatic Classi- fication of Malware Images.” In 2025 4th International Conference on Sentiment Analysis and Deep Learning (ICSADL) , pp. 1329–1333. IEEE, 2025. [Online]. Available: https://doi.org/10.1109/ICSADL65848. 2025.10933410
2025
-
[11]
”Comparative Analysis of Federated Learning, Deep Learning, and Traditional Machine Learning Techniques for IoT Malware Detection
Darwish, Rami, and Kaushik Roy. ”Comparative Analysis of Federated Learning, Deep Learning, and Traditional Machine Learning Techniques for IoT Malware Detection. ”In 2025 IEEE 4th International Confer- ence on AI in Cybersecurity (ICAIC), pp. 1–10. IEEE, 2025. [Online]. Avail...
2025
-
[12]
G, Sweety Prasanna Kiruba, Shubha G. Sanu, K. Saranya, Tatiraju V . Rajani Kanth, and S. Mahesh. ”Dynamic Malware Classification and Signature Generation Using Multi-View Convolutional Neural Net- works. ”In 2024 International Conference on Integrated Intelligence and Communic...
2024
-
[15]
Manjunath
Nataraj, Lakshmanan, Sreejith Karthikeyan, Gregoire Jacob, and Ban- galore S. Manjunath. ”Malware images: visualization and automatic classification. ”In Proceedings of the 8th international symposium on visualization for cyber security , pp. 1-7. 2011. [Online]. Available: ht...
2011
-
[16]
VirusShare Malware Repository
VirusShare. VirusShare Malware Repository. [Online]. Available: https: //virusshare.com/ [Accessed: 2025-04-14]
2025
-
[17]
Automated Malware Analysis
Cuckoo Sandbox. Automated Malware Analysis . [Online]. Available: https://cuckoosandbox.org/about.html [Accessed: 2025-04-14]
2025
-
[21]
Available at: https://doi.org/10
Bishwajit Prasad Gond and Md Shahnawaz, Malware Benign Image Classification Dataset , 2025, Kaggle. Available at: https://doi.org/10. 34740/KAGGLE/DSV/11412547
2025
-
[2022]
Available: https://doi.org/10.1109/JIOT.2021.3100063
[Online]. Available: https://doi.org/10.1109/JIOT.2021.3100063
2021
-
[2024]
Available: https://doi.org/10.1109/ICEENG58856.2024
[Online]. Available: https://doi.org/10.1109/ICEENG58856.2024. 10566448
2024
Reviewed August 7, 2026 · model on record in the stance chip above.
Discussion (0). Sign in to comment.