Pith. sign in

REVIEW 4 major objections 6 minor 1 cited by

Dynamic Malware Classification of Windows PE Files using CNNs and Greyscale Images Derived from Runtime API Call Argument Conversion

T0 review · 4 major / 6 minor · reviewed 2026-08-07 · deepseek-v4-flash

Pith's one-line read A CNN trained on grayscale images of runtime API call arguments classifies Windows PE malware into seven families plus benign with 98.36% average accuracy, and the paper claims this behavioral representation withstands common evasion…

desk verdict The reported 98.36% accuracy is not credible from the paper's own numbers, but the dynamic API-argument-to-image pipeline and the released dataset are worth a second look after a careful revision. read the letter →

arxiv 2505.24231 v1 pith:6LGQNIC5 submitted 2025-05-30 cs.LG cs.AIcs.CR

classification cs.LGcs.AIcs.CR
keywords malwareclassificationdynamicanalysisAPIcallargumentsconvolutionalneuralnetworkgrayscaleimagesWindowsPEfilesCuckooSandboxmagmacolormap
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper aims to establish that a Windows malware classifier can be built entirely from runtime behavior, not from the file's bytes: sandbox logs of API calls, their arguments, and return values are flattened into unigrams, normalized, and rendered as 128x128 grayscale images colored with a magma map. A compact three-convolution CNN trained on 17,544 such images then labels unseen samples into seven malware families plus benign. On a test set of 4,512 samples from a 22,056-sample dataset, the authors report 98.36% average accuracy, with per-class accuracy above 97% and perfect scores for the downloader class. The authors also claim the behavioral image representation resists typical evasion strategies, which matters because static and signature-based analysis fails against polymorphic and metamorphic malware.

What carries the argument

The central object is the API-call-argument unigram image: each sample's behavioral report is reduced to a frequency vector of unigrams such as API name plus argument string, normalized, and reshaped into a 128x128 pixel map. The resulting grayscale image, later recolored with a magma map, encodes which system interactions occurred and how often, allowing the CNN's convolutional filters to learn spatial patterns that stand in for behavior. The compact CNN with three convolution-pool blocks, a dropout dense layer, and an 8-way softmax carries out the classification.

What would settle it

Run the trained model on a fresh set of malware whose labels are independently established, while re-running each sample twice in the sandbox to measure log stability; if accuracy collapses on samples that detect the sandbox, or if repeat runs give different images for the same file, the claimed resilience and accuracy would not hold outside the original dataset.

Watch

Extended reading notes

Core claim

The paper's central claim is that dynamic API call arguments, converted into images, are discriminative enough for a generic CNN to classify malware families with high accuracy and robustness. The authors' pipeline executes each Windows PE sample in a sandbox, records the behavioral report, splits it into API category, name, argument, and return, and builds unigrams of the form API name plus argument. After normalization to 0–255 and reshaping into 128x128 matrices, the images are enhanced with Gaussian blur, CLAHE, and Sobel edge detection, recolored with a magma colormap, and fed to a three-convolutional-layer CNN with dropout and softmax over eight classes. The reported evaluation uses 22,056 samples (17,544 train, 4,512 test) and yields 98.36% average accuracy; the confusion matrix shows clean separation for downloader and benign samples, with most confusion in adware, backdoor, and worm classes. The authors conclude that behavior-derived images capture both structural and temporal features, making the method suitable for evasive malware that static analysis misses.

Load-bearing premise

The whole result depends on the sandbox logs being a faithful picture of what each sample really does and on the seven family labels in the dataset being correct and non-overlapping; if a sample evades the sandbox or is mislabeled, the 98.36% number does not reflect real-world classification skill.

Editorial extensions

If this is right

  • A detector built on runtime behavior can in principle catch polymorphic and metamorphic variants that keep their actions while changing their code.
  • The API-call-argument unigrams carry enough information that a generic CNN separates eight classes from images alone, without manually engineered signatures.
  • The 128x128 image format and the small three-convolution network keep training feasible on ordinary GPU hardware, supporting deployment in settings with limited compute.
  • The reported confusion pattern implies that downloaders and benign files are nearly perfectly separated, while most mistakes concentrate in adware, backdoor, and worm classes.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The paper leaves implicit that the same encoding should be tested against API-name-only images; dropping the argument component would reveal whether the accuracy gain comes from arguments or merely from call names.
  • A direct check of the evasion claim would run the model on samples known to detect sandboxes or that change their API behavior across executions; the reported results do not include such a test.
  • Because the image representation is agnostic to the operating system, the pipeline could be lifted to Android or Linux by substituting system-call logs for Windows API calls.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 6 minor

Summary. The paper proposes a malware classification pipeline for Windows PE files that runs samples in Cuckoo Sandbox, extracts API call names and arguments as unigram features, normalizes and reshapes each sample's feature vector into a 128x128 image, applies enhancement and a magma colormap, and trains a CNN to classify the images into seven malware families plus benign. The authors report an average accuracy of 98.36% and claim resilience against typical evasion strategies. The dataset is a new, self-created corpus of 22,056 samples (reference [18]). The core empirical claim rests on Tables I-III and Figure 4, but the evaluation tables are internally inconsistent with the stated test split, which is the central problem with the manuscript.

Significance. If the reported accuracy were reliably established, the work would be a useful example of integrating dynamic behavioral analysis with CNN-based image classification, with a relatively large self-collected dataset and a simple, reproducible pipeline. The authors provide a dataset DOI [18], which supports reproducibility. However, the main numerical claim is not currently supported: the confusion matrix in Table III cannot be reconciled with the test split in Table I, and no explanation is offered. In addition, the advertised resilience to evasion is asserted but never experimentally tested. The underlying idea is not new (API-sequence-to-image CNN classification has appeared before), but the specific encoding and dataset could still be of interest if the evaluation were sound.

major comments (4)
  1. [Section VI, Tables I and III] The confusion matrix row sums in Table III are inconsistent with the test set sizes in Table I. For each class, TP+FN equals the true number of test samples from that class, but Table III gives Adware 312+85=397 versus 316 in Table I, Backdoor 114+21=135 versus 228, Spyware 160+29=189 versus 167, Trojan 641+73=714 versus 675, Virus 446+33=479 versus 464, Worm 247+24=271 versus 305, and Benign 1704+23=1727 versus 1857; only Downloader matches. The row totals sum to 4412, not the stated 4512 test samples. The per-class accuracies in Table II (e.g., Adware (312+4011)/4412=98.0%, Trojan (641+3664)/4412=97.6%) are exactly what one computes from Table III with the 4412 denominator, so the headline 98.36% accuracy inherits this mismatch. The paper provides no explanation for the missing 100 samples or the per-class discrepancies. As a result, the central claim of effective classification at 98.36% accuracy is not supported by the manuscript's own evaluation tables and must be corrected or thoroughly explained.
  2. [Abstract and Section VI] The abstract claims the method 'demonstrates significant resilience against typical evasion strategies,' but the paper contains no experiment that tests evasion, adversarial perturbations, obfuscation, or concept drift. The only related statements are qualitative remarks in the introduction and conclusion. Since this is a load-bearing part of the abstract's claim, the authors should either remove the claim or add a concrete evaluation (e.g., classifying packed/obfuscated samples, or applying adversarial perturbations to the images).
  3. [Section IV, Phase 2 and Table I] The ground-truth labels of the dataset (reference [18]) are load-bearing for every reported metric, but the paper does not describe how the labels were obtained, validated, or deduplicated. The samples come from VirusShare/VirusTotal, yet the classification target (e.g., 'Backdoor' vs 'Trojan') depends on the labels assigned in the authors' Kaggle dataset. The paper should describe the labeling procedure, the number of antivirus engines or other sources used, and any quality controls. Without this, the 98.36% figure could reflect label noise or label leakage rather than behavior learned from API calls.
  4. [Section IV, Phase 4 (Feature Transformation)] The transformation from the unigram feature vector to a 128x128 image is central to the method, but the paper does not justify why a row-major reshape places semantically related features near each other. Equation (2) defines I(x,y)=f(X) without specifying f, and the text simply states that CNNs 'find underlying spatial patterns.' In the absence of a meaningful spatial arrangement, the CNN's translation-invariance and local connectivity may actually harm performance compared to a plain MLP. The authors should at least discuss this assumption and, ideally, compare against a non-image baseline (e.g., a fully connected network on the same feature vector) to show that the image representation contributes positively.
minor comments (6)
  1. [Title and Abstract] The title and abstract repeatedly call the images 'grayscale,' but the method applies a magma colormap, which is a color map. This is contradictory; clarify whether the final images fed to the CNN are single-channel grayscale or three-channel RGB after colormapping.
  2. [Section III] In the discussion of Sasikala and Shanmuganathan [5], the sentence 'This method reached 10% level of accuracy' is confusing; it likely should read '100%' or a specific figure. Please correct and ensure the description matches the cited work.
  3. [Table IV] For the proposed work, the 'Detection' column is marked '✗', which contradicts the paper's claim of detecting malware. Also, the dataset is listed as VirusShare [16] while Section V states the experiments use the authors' Kaggle dataset [18]. Make Table IV consistent with the main text.
  4. [Section IV, Phase 1] The unigram feature construction is described only in high-level terms ('API name is the first part and the API call argumant is added using underscores'). Please report the total vocabulary size, the frequency threshold (if any), and how the numeric values in the CSV were derived (counts? TF-IDF? binary indicators?).
  5. [Section V / Footnote 3] The footnote 'Code and Dataset' promises code availability, but no URL is given. For reproducibility, provide a link to the code repository and the exact version of the dataset used.
  6. [Section II, 'Experimental Conversion of Features into Image'] This subsection appears in Basic Concepts yet describes the paper's own pipeline; it would fit better in Section IV. Also, the sentence 'The mapping of features to their images is IMAGE[EXEMPLAR][DENSITY][LIGHT][ANGLE]' is opaque and should be removed or rephrased.

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity: the CNN is trained on one split and evaluated on a held-out test split, with no fitted parameter renamed as a prediction; self-cited prior work and the self-published dataset are contextual or source data, not premises that force the conclusion.

full rationale

The paper's derivation chain is an empirical pipeline: Cuckoo Sandbox behavioral reports (Section IV Phase 1) are reduced to API-name/argument unigrams, converted to normalized 128x128 images, and fed to a three-convolution-layer CNN trained on 17,544 samples and evaluated on a held-out 4,512-sample test split (Section V, Table I). The test set is not used for training or for setting any hyperparameter, so the reported accuracy is an out-of-sample measurement rather than a fitted input renamed as a prediction. No equation defines the target claim in terms of its own inputs: Equation (1) is the standard convolution definition and Equation (2) is a generic statement that a feature vector is mapped to an image grid; neither embeds the classification result. The self-authored references ([13], [14], [15]) are related-work descriptions and do not supply any load-bearing premise, and the self-published dataset ([18]) is the data source whose labels come from external repositories (VirusShare/VirusTotal), not from the model output, so the evaluation is externally falsifiable rather than definitionally forced. Two flagged weaknesses are correctness issues rather than circularity: (a) Table III row sums total 4,412 while Table I states a 4,512 test split (per-class counts also differ, e.g., Adware 397 vs 316), so the headline 98.36% - the unweighted average of Table II per-class accuracies - is not reproducible from the stated test set; note also that this class-balanced average is not the overall accuracy (4,124 of 4,412 is about 93.5%), a transparency issue; and (b) the abstract's claim of 'significant resilience against typical evasion strategies' has no corresponding experiment in the paper. Neither issue involves a derivation that reduces to its own inputs.

Assumptions & free parameters 4 free parameters · 4 assumptions · 0 invented entities

The central accuracy claim depends on the fidelity of sandboxed execution, the correctness of externally sourced labels, and the ad hoc image-reshaping assumption. The paper provides no ablations to test these dependencies and no external benchmark. The CNN weights are learned, and numerous hyperparameters are chosen by hand without sensitivity analysis, so the contribution is an empirical pipeline rather than a derivation.

free parameters (4)
  • Image size = 128x128
    Chosen by hand to reshape the normalized per-sample feature vector; no sensitivity analysis or justification is provided.
  • CNN hyperparameters = 32/64/128 filters, kernel 3, dense 256, dropout 0.5, 100 epochs
    Selected without ablation or search; the reported accuracy depends on these settings.
  • Unigram feature count = not stated
    The number of API name-argument unigrams determines the vector length that is normalized and reshaped; the paper does not state it.
  • Train/test split ratio = 17544/4512 (about 80/20)
    Chosen by hand; no stratification details or repeated splits are reported.
assumptions (4)
  • domain assumption Cuckoo Sandbox reports accurately capture the true runtime behavior of each PE sample.
    The entire dynamic feature set is derived from these reports (Section IV Phase 1), and no validation against ground-truth behavior or sandbox-evasion checks is reported.
  • domain assumption Labels from VirusShare/VirusTotal and the authors' Kaggle dataset are correct and class-disjoint.
    The paper uses these labels as ground truth for training and testing (Section IV Phase 1, Table I); no label verification or disagreement analysis is described.
  • ad hoc to paper Flattening the feature vector into a row-major 128x128 grid places related features near each other so that spatial convolutions are meaningful.
    Phase 3 says vectors are simply reshaped into square matrices; no ordering rationale is given, so the spatial structure the CNN relies on is assumed.
  • domain assumption API name plus argument unigrams are stable, discriminative behavioral features.
    The method selects API name and argument and discards API category and return values (Section IV Phase 1); no ablation supports this choice.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Dynamic Malware Classification of Windows PE Files using CNNs and Greyscale Images Derived from Runtime API Call Argument Conversion." pith.science (2026). https://pith.science/paper/6LGQNIC5

@misc{pith2026250524231,
  author       = {Pith},
  title        = {Pith review of: Dynamic Malware Classification of Windows PE Files using CNNs and Greyscale Images Derived from Runtime API Call Argument Conversion},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/6LGQNIC5}},
  note         = {Machine review of arXiv:2505.24231}
}
read the original abstract

Malware detection and classification remains a topic of concern for cybersecurity, since it is becoming common for attackers to use advanced obfuscation on their malware to stay undetected. Conventional static analysis is not effective against polymorphic and metamorphic malware as these change their appearance without modifying their behavior, thus defying the analysis by code structure alone. This makes it important to use dynamic detection that monitors malware behavior at runtime. In this paper, we present a dynamic malware categorization framework that extracts API argument calls at the runtime execution of Windows Portable Executable (PE) files. Extracting and encoding the dynamic features of API names, argument return values, and other relative features, we convert raw behavioral data to temporal patterns. To enhance feature portrayal, the generated patterns are subsequently converted into grayscale pictures using a magma colormap. These improved photos are used to teach a Convolutional Neural Network (CNN) model discriminative features, which allows for reliable and accurate malware classification. Results from experiments indicate that our method, with an average accuracy of 98.36% is effective in classifying different classes of malware and benign by integrating dynamic analysis and deep learning. It not only achieves high classification accuracy but also demonstrates significant resilience against typical evasion strategies.

Figures

Figures reproduced from arXiv: 2505.24231 by the authors.

Figure 1
Figure 1. Proposed CNN-based Architecture for Malware Analysis [PITH_FULL_IMAGE:figures/full_fig_p004_1.png] view at source ↗
Figure 2
Figure 2. A sample image after applying Magma Colormap [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 3
Figure 3. CNN Model Architecture contrast and sharpness improvements were applied before saving the images to disk for training. Phase 4: Model Training and Evaluation Phase This phase includes the design, training, and evaluation of a CNN model tailored for malware classification using grayscale images generated from API call patterns. 1) CNN Model Architecture: The architecture for our CNN model is defined as follows: Input… view at source ↗
Figures from the paper (3 more)
Figure 4
Figure 4. Figure 4: Confusion Matrix of malware classification [PITH_FULL_IMAGE:figures/full_fig_p006_4.png]
Figure 5
Figure 5. Figure 5: Bar graph comparing Accuracy, F1 Score, Recall, and [PITH_FULL_IMAGE:figures/full_fig_p006_5.png]
Figure 6
Figure 6. Figure 6: Loss and Accuracy measures for proposed model [PITH_FULL_IMAGE:figures/full_fig_p007_6.png]

Discussion (0). Sign in to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. System Calls for Malware Detection and Classification: Methodologies and Applications

    cs.CR 2025-06 unverdicted novelty 2.0 of 10

    A survey of system call and API call based malware detection that consolidates known methodologies and repeats the authors' previously published accuracy results.

Reference graph

Works this paper leans on

21 extracted references · 15 canonical work pages · cited by 1 Pith paper

  1. [18]

    ”Family Classification of Malicious Applications using Hybrid Analysis and Computationally Economical Machine Learning Techniques

    Kishore, Pushkar, Swadhin Kumar Barisal, and Durga Prasad Mohapatra. ”Family Classification of Malicious Applications using Hybrid Analysis and Computationally Economical Machine Learning Techniques. ” In 2022 IEEE/WIC/ACM International Joint Conference on Web In- telligence and Intelligent Agent Technology (WI-IAT) , pp. 442–449. IEEE, 2022. [Online]. Av...

  2. [13]

    ”A Deep Learning Framework for Malware Classification using NLP Techniques

    Gond, Bishwajit Prasad, Atul Kumar Singh, and Durga Prasad Mohapa- tra. ”A Deep Learning Framework for Malware Classification using NLP Techniques. ”In 2024 15th International Conference on Computing Communication and Networking Technologies (ICCCNT) , pp. 1–8. IEEE, 2024. [Online]. Available: https://doi.org/10.1109/ICCCNT61001. 2024.10725427

  3. [14]

    ”Enhancing Malware Classification with Machine Learning: A Comparative Analysis of API Sequence-Based Techniques

    Rajneekant, Pushkar Kishore, Bishwajit Prasad Gond, and Durga Prasad Mohapatra. ”Enhancing Malware Classification with Machine Learning: A Comparative Analysis of API Sequence-Based Techniques. ” In 2024 IEEE International Conference on Smart Power Control and Re- newable Energy (ICSPCRE), pp. 1–6. IEEE, 2024. [Online]. Available: https://doi.org/10.1109/...

  4. [1]

    Global Cybersecurity Outlook 2025

    World Economic Forum. Global Cybersecurity Outlook 2025. 2025. [Online]. Available: https://reports.weforum.org/docs/WEF Global Cybersecurity Outlook 2025.pdf [Accessed: 2025-04-13]

  5. [2]

    ”CNN-Based Malware Family Classification and Evaluation

    Hebish, Mohamed Wael, and Mohamed Awni. ”CNN-Based Malware Family Classification and Evaluation. ” In 2024 14th International Conference on Electrical Engineering (ICEENG), pp. 219–224. IEEE,

  6. [3]

    ”Enhancing Malware Classification Through Dynamic Behavioral Anal- ysis, SIEM Integration, and Deep Learning

    Javed, Sheikh Muhammad Zeeshan, and Muhammad Faisal Amjad. ”Enhancing Malware Classification Through Dynamic Behavioral Anal- ysis, SIEM Integration, and Deep Learning. ” In 2024 International Seminar on Intelligent Technology and Its Applications (ISITIA) , pp. 663–668. IEEE, 2024. [Online]. Available: https://doi.org/10.1109/ ISITIA63062.2024.10667741

  7. [4]

    ”Visual Malware Classification Using a CNN.” In 2024 IEEE MIT Undergraduate Research Technology Conference (URTC) , pp

    Peng, Derek, Mohammed Husain, Abdullah Siddiqui, and Srijit Bhat- tacharya. ”Visual Malware Classification Using a CNN.” In 2024 IEEE MIT Undergraduate Research Technology Conference (URTC) , pp. 1–5. IEEE, 2024. [Online]. Available: https://doi.org/10.1109/ URTC65039.2024.10937559

  8. [5]

    Shanmuganathan

    Sasikala, L., and C. Shanmuganathan. ”Effective Malware Classification using Fine-tuned CNN Architecture: An Image-Based Approach. ” In 2024 2nd International Conference on Networking and Commu- nications (ICNWC) , pp. 1–6. IEEE, 2024. [Online]. Available: https: //doi.org/10.1109/ICNWC60771.2024.10537444

Show all 21 references
  1. [6]

    Musaev, Akobir, Abdulaziz Anorboev, and Jonghee M. Youn. ”Opti- mized Epoch Selection Ensemble: Integrating Custom CNN and Fine- Tuned MobileNetV2 for Malimg Dataset Classification. ” IEEE Access, vol. 13, pp. 45623–45633, 2025. [Online]. Available: https://doi.org/10. 1109/AC...

  2. [7]

    ”MVC-RSN: A Malware Classification Method With Variant Identification Ability

    Wu, Wei, Haipeng Peng, Haotian Zhu, and Lixiang Li. ”MVC-RSN: A Malware Classification Method With Variant Identification Ability. ” IEEE Internet of Things Journal , vol. 11, no. 21, pp. 35654–35668,

  3. [8]

    ”IoT Malware Classification Based on Lightweight Convolutional Neural Net- works

    Yuan, Baoguo, Junfeng Wang, Peng Wu, and Xianguo Qing. ”IoT Malware Classification Based on Lightweight Convolutional Neural Net- works. ”IEEE Internet of Things Journal, vol. 9, no. 5, pp. 3770–3783,

  4. [9]

    Available: https://doi.org/10.1109/JIOT.2024.3436903

    [Online]. Available: https://doi.org/10.1109/JIOT.2024.3436903

  5. [10]

    ” Mal Class: A Deep Learning Approach for Automatic Classi- fication of Malware Images.” In 2025 4th International Conference on Sentiment Analysis and Deep Learning (ICSADL) , pp

    S, Divya. ” Mal Class: A Deep Learning Approach for Automatic Classi- fication of Malware Images.” In 2025 4th International Conference on Sentiment Analysis and Deep Learning (ICSADL) , pp. 1329–1333. IEEE, 2025. [Online]. Available: https://doi.org/10.1109/ICSADL65848. 2025.10933410

  6. [11]

    ”Comparative Analysis of Federated Learning, Deep Learning, and Traditional Machine Learning Techniques for IoT Malware Detection

    Darwish, Rami, and Kaushik Roy. ”Comparative Analysis of Federated Learning, Deep Learning, and Traditional Machine Learning Techniques for IoT Malware Detection. ”In 2025 IEEE 4th International Confer- ence on AI in Cybersecurity (ICAIC), pp. 1–10. IEEE, 2025. [Online]. Avail...

  7. [12]

    G, Sweety Prasanna Kiruba, Shubha G. Sanu, K. Saranya, Tatiraju V . Rajani Kanth, and S. Mahesh. ”Dynamic Malware Classification and Signature Generation Using Multi-View Convolutional Neural Net- works. ”In 2024 International Conference on Integrated Intelligence and Communic...

  8. [15]

    Manjunath

    Nataraj, Lakshmanan, Sreejith Karthikeyan, Gregoire Jacob, and Ban- galore S. Manjunath. ”Malware images: visualization and automatic classification. ”In Proceedings of the 8th international symposium on visualization for cyber security , pp. 1-7. 2011. [Online]. Available: ht...

  9. [16]

    VirusShare Malware Repository

    VirusShare. VirusShare Malware Repository. [Online]. Available: https: //virusshare.com/ [Accessed: 2025-04-14]

  10. [17]

    Automated Malware Analysis

    Cuckoo Sandbox. Automated Malware Analysis . [Online]. Available: https://cuckoosandbox.org/about.html [Accessed: 2025-04-14]

  11. [21]

    Available at: https://doi.org/10

    Bishwajit Prasad Gond and Md Shahnawaz, Malware Benign Image Classification Dataset , 2025, Kaggle. Available at: https://doi.org/10. 34740/KAGGLE/DSV/11412547

  12. [2022]

    Available: https://doi.org/10.1109/JIOT.2021.3100063

    [Online]. Available: https://doi.org/10.1109/JIOT.2021.3100063

  13. [2024]

    Available: https://doi.org/10.1109/ICEENG58856.2024

    [Online]. Available: https://doi.org/10.1109/ICEENG58856.2024. 10566448

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.