HilEnT: Hilbert, Entropy Transformed Image Based Malware Detection

Kar Wai Fok; Rahul Kale; Thesath Wijayasiri; Vrizlynn L. L. Thing

REVIEW 3 major objections 4 minor 39 references

HilEnT: Hilbert, Entropy Transformed Image Based Malware Detection

T0 review · 3 major / 4 minor · reviewed 2026-07-11 · grok-4.5

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read A three-channel Hilbert-plus-entropy image lets a shallow CNN match deep malware detectors on PE files.

desk verdict Solid engineering paper: a concrete three-channel PE image (Hilbert + two class-relative entropy maps) that matches deeper SOTA with a shallow CNN and much faster HOG-PCA inference; the borrowed-benign and cut-off issues are real but do not erase the multi-dataset numbers. read the letter →

arxiv 2607.04772 v1 pith:24UTFG4P submitted 2026-07-06 cs.CR

Rahul Kale , Thesath Wijayasiri , Kar Wai Fok , Vrizlynn L. L. Thing This is my paper · ORCID

classification cs.CR

keywords malwaredetectionvisualizationHilbertcurveentropycontrastfew-shotlearningHOG-PCAconvolutionalneuralnetworkPEbinaries

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper claims that malware binaries can be turned into images that already carry the features a detector needs, so even a three-layer network can match deeper models. The method, called HilEnT, maps each file into three grayscale channels: a Hilbert-curve layout that keeps nearby bytes together, a benign-entropy contrast map that lights up low-entropy blocks relative to the training benign average, and a malware-entropy contrast map that lights up high-entropy blocks relative to the training malware average. The three channels become a single RGB image that is fed to a lightweight CNN, optionally after HOG-PCA feature reduction, or to a few-shot Siamese network when only a handful of samples per family exist. On four PE datasets the resulting detectors reach binary accuracies of 0.94–0.99 and multiclass accuracies of 0.95–0.97, matching or exceeding deeper convolutional baselines while cutting per-sample inference time by roughly two orders of magnitude when HOG-PCA is used. The practical payoff is a static, sandbox-free detector that stays accurate even when labelled malware of every family is scarce.

What carries the argument

HilEnT transformation: each binary is rendered as a fixed-size RGB image whose red channel is a Hilbert-curve layout of the bytes, green channel is a benign-entropy contrast map, and blue channel is a malware-entropy contrast map, both maps using training-set class-average entropy cut-offs.

What would settle it

Recompute the benign and malware entropy cut-offs on a fresh, multi-year PE corpus drawn from sources never seen in training, then measure whether binary and multiclass accuracy of the same three-layer CNN drop by more than a few points relative to the numbers reported on the original four datasets.

Watch

Extended reading notes

Core claim

The authors establish that a three-channel image formed from a Hilbert-curve grayscale map plus two class-average entropy contrast maps supplies enough structural and statistical signal for a three-layer CNN (and for HOG-PCA or few-shot Siamese variants) to achieve state-of-the-art binary and multiclass malware detection on four PE datasets while remaining faster at inference than deeper image-based detectors.

Load-bearing premise

The two class-average entropy thresholds computed only on the training split stay stable and still separate benign from malware regions for test files that may come from different sources or years.

Editorial extensions

If this is right

Endpoint detectors can replace deep CNNs with a three-layer network plus the HilEnT image without sacrificing accuracy on PE binaries.
HOG-PCA applied to HilEnT images yields roughly two-order-of-magnitude faster per-sample inference, enabling real-time static scanning on modest hardware.
Few-shot Siamese classification on HilEnT images remains competitive when only one or ten labelled samples per family are available, reducing the need for large labelled malware collections.
Because class-level entropy cut-offs adapt to the training distribution, the same pipeline can be retrained on new corpora without manual threshold retuning.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

If the Hilbert-plus-entropy encoding already concentrates family-specific structure, multimodal fusion with PE headers or API import graphs may add only marginal gains for pure PE detection.
The same three-channel recipe could be tried on non-PE formats (ELF, Android APK, PDF) by recomputing only the two entropy cut-offs, testing whether the locality-plus-entropy idea is format-agnostic.
Low-footprint code injection that barely shifts block entropy would be a natural adversarial probe of the contrast maps’ robustness.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

The one thing worth knowing is that HilEnT is a usable, incremental visualization trick, not a new theory of malware. They take a Hilbert grayscale channel (already in Vu/Wijayasiri), add two entropy-contrast channels that compare each block against the training-set average entropy of the benign class and of the malware class, stack them into an RGB image, and feed a three-layer CNN. On four PE datasets the numbers sit at or above the usual Nataraj/Conti/Hemalatha/Lo baselines while the network stays tiny and HOG+PCA drops per-sample time by roughly two orders of magnitude. That combination is new and the tables (3, 5, 7–10) are thorough enough to trust for within-subfield work.

What they do well: multi-dataset evaluation (Dike, Lester, BIG 2015, self-collected), explicit 5-fold and 80/20 splits, head-to-head grayscale ablations, few-shot CSNN numbers, and a clear timing table. The architecture is deliberately shallow; they own that choice and show it still works. Circularity is low—the cut-offs are ordinary training-set statistics applied to held-out files.

Soft spots, in proportion. The stress-test note is right that ENT_ben / ENT_mal are computed once on the training split and that Microsoft and self-collected experiments reuse the same Lester benign corpus. That means the green/blue channels partly encode “looks like Lester benign” rather than a corpus-native contrast; the paper never fully isolates that factor. Packed samples are dropped from the self-collected set and no code or private data are released, so exact reproduction is only moderate. The abstract’s “state-of-the-art” language is a bit stronger than the body’s “comparable” tables. None of these sink the central empirical claim, but they keep the contribution inside the malware-visualization niche.

This is for people already building image-based PE detectors who care about inference cost and shallow models. It deserves a serious referee; the construction is concrete, the experiments are multi-dataset, and the gaps are the usual ones for the subfield. I would accept for peer review and would cite the three-channel idea if I were doing similar visualization work.

Referee Report

3 major / 4 minor

Summary. The paper introduces HilEnT, a malware binary-to-image transform that produces a three-channel RGB image by stacking a Hilbert-curve grayscale rendering of the byte sequence with two entropy-contrast maps (one relative to the training-set benign average entropy cutoff ENT_ben, one relative to the malware average ENT_mal). The resulting images are fed to a shallow three-layer CNN for supervised binary and multiclass classification, to a HOG+PCA pipeline for faster inference, and to a convolutional Siamese network for few-shot and unseen-class settings. Experiments on Dike, a balanced subsample of the Michael Lester PE corpus, Microsoft BIG 2015, and a self-collected MalwareBazaar set report binary accuracies up to 0.99, multiclass accuracies of 0.95–0.97, competitive few-shot numbers, and roughly two-order-of-magnitude speed-ups when HOG-PCA is used, claimed to match or exceed several recent image-based detectors while using far fewer layers.

Significance. If the reported gains are attributable to the HilEnT channels rather than to dataset construction choices, the work supplies a lightweight, static-only visualization that lets shallow CNNs approach the accuracy of much deeper backbones (Xception, DenseNet) and that supports practical few-shot and low-latency deployment. The multi-dataset evaluation, explicit HOG-PCA timing tables, backbone ablations (Tables 8–10), and public-data baselines constitute a useful empirical contribution for resource-constrained malware detection pipelines.

major comments (3)

[Section 4.1.4 / 3.3.2] Section 4.1.4 states that the Microsoft BIG 2015 and self-collected experiments reuse the identical Lester benign corpus for both binary labels and the computation of ENT_ben. Consequently the green channel of every HilEnT image encodes a comparison against a single external benign distribution rather than against the natural benign distribution of the target corpus. Without an ablation that recomputes the cut-offs on held-out or corpus-matched benign files (or that replaces the borrowed benign set), it is impossible to isolate how much of the three-channel lift over plain Hilbert/Nataraj grayscale (Tables 3, 5, 8) is due to the proposed transform versus the shared benign reference. This is load-bearing for the central claim that HilEnT itself produces the observed gains.
[Section 4.1.4] Section 4.1.4 explicitly excludes packed samples from the self-collected set (via Detect It Easy) and imposes a 5 MB size cap. Packing and light obfuscation are common in real-world PE malware and are precisely the regimes in which entropy-based features are known to be most informative (or most easily spoofed). The paper never reports results on packed counterparts or on an unrestricted size distribution; therefore the claimed detection rates and the utility of the malware-entropy channel cannot be taken as representative of operational conditions. An evaluation (or at least a quantified sensitivity study) on packed samples is required before the SOTA claim can be accepted.
[Abstract / Table 7 / Section 6] The abstract and conclusion assert that the method “achieved the state-of-the-art results,” yet Table 7 shows multiclass accuracy 0.5–1.5 points below the cited SoTA numbers of Lo et al., Hemalatha et al. and Conti et al. on the same Microsoft BIG 2015 split. While the shallower architecture is a legitimate efficiency argument, the unqualified SOTA language overstates the empirical outcome and should be revised to “comparable accuracy with substantially lower model complexity.”

minor comments (4)

[Tables 3–4] Table 3 reports a single HilEnT accuracy column without clarifying whether HOG-PCA was applied; the corresponding timing column in Table 4 suggests it was not. Explicitly label the configuration for every entry.
[Section 3.3.2] Section 3.3.2 normalizes the malware-entropy channel by the constant 8 (maximum byte entropy). A short justification or sensitivity check for this hard-coded upper bound would improve reproducibility.
[Figures 2–4] Figures 2–4 are useful but lack scale bars or intensity legends; adding them would make the visual contribution of each channel clearer to non-specialists.
[Throughout] A few typographical inconsistencies appear (e.g., “HilEnTbased”, “MicrosoftBIG”, missing spaces after periods). A careful proof-read would remove them.

Circularity Check

0 steps flagged · score 1.0 of 10

No load-bearing circularity: train-set entropy cut-offs and Hilbert baseline are standard empirical construction, not self-definitional or forced predictions.

full rationale

HilEnT defines two entropy channels by computing class averages ENT_ben and ENT_mal exclusively on the training split (Sec. 3.3.2) and then applying the fixed cut-offs to every file; the resulting three-channel images are fed to ordinary supervised or few-shot classifiers whose accuracies (Tables 3, 5, 7–10) are measured on held-out data. This is textbook feature engineering, not a definitional loop or a fitted parameter re-labeled as a prediction. The only self-citation (Wijayasiri et al. 2025) supplies the Hilbert-curve mapping that the authors themselves alter to grayscale; it does not underwrite the novel entropy channels or the reported gains. No uniqueness theorem, ansatz smuggling, or renaming of a known result appears. The central empirical claims therefore stand or fall on external benchmarks and are not circular by construction.

Assumptions & free parameters 5 free parameters · 3 assumptions · 1 invented entities

The central empirical claim rests on a handful of design choices (block size, image size, entropy cut-off definitions, CNN depth) that are fixed by the authors rather than derived, plus the domain assumption that static PE bytes plus class-average entropy suffice for family discrimination. No new physical entities are postulated; HilEnT is an engineered representation.

free parameters (5)

block_size_for_entropy = 256
Fixed at 256 bytes with no ablation; directly determines which regions light up in the two entropy channels.
final_image_size = 256x256
All Hilbert images are bilinearly resized to 256×256; choice affects both accuracy and speed but is not justified by theory.
ENT_ben / ENT_mal cut-offs = dataset-specific averages
Computed as mean file entropy over the training benign and malware sets; they are data-dependent free parameters that adapt per dataset.
CNN architecture depth and kernel sizes = 3 conv + 3 FC
Three 3×3 conv layers + three FC layers chosen by hand; no architecture search reported.
HOG cell size and PCA variance retained = 8x8 / 95%
8×8 cells and 95 % cumulative variance fixed across all experiments.

assumptions (3)

domain assumption Static byte sequences of PE files, when laid out by a Hilbert curve and contrasted against class-average entropy, contain sufficient discriminative structure for both binary and family-level classification.
Stated throughout Section 3; never proved, only validated empirically on the four chosen corpora.
ad hoc to paper Packed or heavily obfuscated samples can be excluded without loss of generality for the claimed detection rates.
Self-collected dataset explicitly drops packed samples via Detect-It-Easy (Section 4.1.4); no experiment shows the method still works when packing is present.
ad hoc to paper Benign files drawn from the Lester corpus are distributionally representative for the Microsoft BIG and self-collected malware sets.
Explicitly used because those two malware sets lack their own benign files (Section 4.1).

invented entities (1)

HilEnT three-channel image
purpose: Unified visual representation that encodes both locality-preserving byte order and class-relative entropy contrast for downstream classifiers.
Defined in Section 3.3; the paper’s entire empirical contribution is the claim that this particular construction improves or matches prior visualizations.

how reviews work

0 comments

Cite this review

Pith. "Pith review of HilEnT: Hilbert, Entropy Transformed Image Based Malware Detection." pith.science (2026). https://pith.science/paper/24UTFG4P

@misc{pith2026260704772,
  author       = {Pith},
  title        = {Pith review of: HilEnT: Hilbert, Entropy Transformed Image Based Malware Detection},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/24UTFG4P}},
  note         = {Machine review of arXiv:2607.04772}
}

read the original abstract

With the increasing threat of malware across various software related domains, malware detection and classification is critical to determine the response actions. Different strategies have been adopted to address the challenge of malware detection. With the advent of deep learning techniques, malware detection using image processing has garnered research attention. In this work, we proposed a novel malware binary to image transformation technique HilEnT based on a combination of Hilbert curve-based transformation of malware binary and the entropy feature comparison of malware file with benign and malware classes. Three grayscale images produced during this process are combined to form a three-channel colored image which is then used for malware detection using machine learning techniques. We performed supervised binary and multiclass classification to evaluate the effectiveness of our proposed HilEnT. We also evaluated a few-shot learning technique to assess the robustness of our proposed HilEnT in a practical setting where the number of available class samples is limited. Furthermore, we investigated the benefits of combination of Histogram of Oriented Gradients and Principal Component Analysis for time performance improvements through feature reduction techniques. We evaluated our proposed methodology on four datasets: Dike, Michael Lester Dataset, Microsoft BIG 2015 and a self-collected dataset, and achieved the state-of-the-art results.

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

39 extracted references · 3 linked inside Pith

[1]

Machine Learning With Applications , volume=

A survey of malware detection using deep learning , author=. Machine Learning With Applications , volume=. 2024 , publisher=

2024
[2]

VRL, ECE , volume=

Detecting packed executables based on raw binary data , author=. VRL, ECE , volume=
[3]

Knowledge-Based Systems , volume=

CNN-LSTM and transfer learning models for malware classification based on opcodes and API calls , author=. Knowledge-Based Systems , volume=. 2024 , publisher=

2024
[4]

Security in Computing and Communications: International Symposium, SSCC 2013, Mysore, India, August 22-24, 2013

Malware detection using API function frequency with ensemble based classifier , author=. Security in Computing and Communications: International Symposium, SSCC 2013, Mysore, India, August 22-24, 2013. Proceedings 1 , pages=. 2013 , organization=

2013
[5]

2015 IEEE International Conference on Software Quality, Reliability and Security , pages=

Machine learning based hybrid behavior models for Android malware analysis , author=. 2015 IEEE International Conference on Software Quality, Reliability and Security , pages=. 2015 , organization=

2015
[6]

Computers & Security , volume=

SynDroid: An adaptive enhanced Android malware classification method based on CTGAN-SVM , author=. Computers & Security , volume=. 2024 , publisher=

2024
[7]

Proceedings of the 15th International Conference on Digital Image Processing , pages=

Dae-ihog: An improved method for classification malware , author=. Proceedings of the 15th International Conference on Digital Image Processing , pages=
[8]

IEEE transactions on pattern analysis and machine intelligence , volume=

One-shot learning of object categories , author=. IEEE transactions on pattern analysis and machine intelligence , volume=. 2006 , publisher=

2006

Show all 39 references

[9]

Procedia Computer Science , volume=

Malware image classification using one-shot learning with siamese networks , author=. Procedia Computer Science , volume=. 2019 , publisher=

2019
[10]

Proceedings of the ACM/IEEE 42nd International Conference on Software Engineering , pages=

Unsuccessful story about few shot malware family classification and siamese network to the rescue , author=. Proceedings of the ACM/IEEE 42nd International Conference on Software Engineering , pages=
[11]

Computers & Security , volume=

A novel few-shot malware classification approach for unknown family recognition with multi-prototype modeling , author=. Computers & Security , volume=. 2021 , publisher=

2021
[12]

Computers & Security , volume=

A few-shot malware classification approach for unknown family recognition using malware feature visualization , author=. Computers & Security , volume=. 2022 , publisher=

2022
[13]

Proceedings of the 8th international symposium on visualization for cyber security , pages=

Malware images: visualization and automatic classification , author=. Proceedings of the 8th international symposium on visualization for cyber security , pages=
[14]

IEEE Transactions on Industrial Informatics , volume=

Detection of malicious code variants based on deep learning , author=. IEEE Transactions on Industrial Informatics , volume=. 2018 , publisher=

2018
[15]

Entropy , volume=

An efficient densenet-based deep learning model for malware detection , author=. Entropy , volume=. 2021 , publisher=

2021
[16]

2019 10th IFIP international conference on new technologies, mobility and security (NTMS) , pages=

An xception convolutional neural network for malware classification with transfer learning , author=. 2019 10th IFIP international conference on new technologies, mobility and security (NTMS) , pages=. 2019 , organization=

2019
[17]

2017 IEEE International Conference on Big Data (Big Data) , pages=

Binary malware image classification using machine learning with local binary pattern , author=. 2017 IEEE International Conference on Big Data (Big Data) , pages=. 2017 , organization=

2017
[18]

IEEE Access , volume=

Intelligent vision-based malware detection and classification using deep random forest paradigm , author=. IEEE Access , volume=. 2020 , publisher=

2020
[19]

IEEE access , volume=

Robust intelligent malware detection using deep learning , author=. IEEE access , volume=. 2019 , publisher=

2019
[20]

Transactions on Emerging Telecommunications Technologies , volume=

HIT4Mal: Hybrid image transformation for malware classification , author=. Transactions on Emerging Telecommunications Technologies , volume=. 2020 , publisher=

2020
[21]

arXiv preprint arXiv:2506.07372 , year=

Enhanced Consistency Bi-directional GAN (CBiGAN) for Malware Anomaly Detection , author=. arXiv preprint arXiv:2506.07372 , year=

arXiv
[22]

Image Analysis and Processing—ICIAP 2015: 18th International Conference, Genoa, Italy, September 7-11, 2015, Proceedings, Part II 18 , pages=

Analysis of HOG suitability for facial traits description in FER problems , author=. Image Analysis and Processing—ICIAP 2015: 18th International Conference, Genoa, Italy, September 7-11, 2015, Proceedings, Part II 18 , pages=. 2015 , organization=

2015
[23]

Imaging and Multimedia Analytics in a Web and Mobile World 2014 , volume=

Efficient eye detection using HOG-PCA descriptor , author=. Imaging and Multimedia Analytics in a Web and Mobile World 2014 , volume=. 2014 , organization=

2014
[24]

Sensors , volume=

Entropy Sharing in Ransomware: Bypassing Entropy-Based Detection of Cryptographic Operations , author=. Sensors , volume=. 2024 , publisher=

2024
[25]

Dike Dataset , howpublished =
[26]

PE Malware Machine Learning Dataset

Lester, Michael , howpublished =. PE Malware Machine Learning Dataset
[27]

arXiv preprint arXiv:1802.10135 , year=

Microsoft malware classification challenge , author=. arXiv preprint arXiv:1802.10135 , year=

arXiv
[28]

Deep convolutional malware classifiers can learn from raw executables and labels only , author=
[29]

Detect It Easy , howpublished =
[30]

the Journal of machine Learning research , volume=

Scikit-learn: Machine learning in Python , author=. the Journal of machine Learning research , volume=. 2011 , publisher=

2011
[31]

2015 , howpublished=

Keras , author=. 2015 , howpublished=

2015
[32]

arXiv preprint arXiv:1912.01703 , year=

Pytorch: An imperative style, high-performance deep learning library , author=. arXiv preprint arXiv:1912.01703 , year=

1912 arXiv
[33]

Computers & Security , volume=

CNN-AutoMIC: Combining convolutional neural network and autoencoder to learn non-linear features for KNN-based malware image classification , author=. Computers & Security , volume=. 2025 , publisher=

2025
[34]

Electronics , volume=

Enhanced Image-Based Malware Classification Using Deep Convolutional Neural Networks , author=. Electronics , volume=. 2024 , publisher=

2024
[35]

Sensors , volume=

Transfer Learning for Image-Based Malware Detection for IoT , author=. Sensors , volume=. 2023 , publisher=

2023
[36]

Computer Networks , volume=

IMCFN: Image-based malware classification using fine-tuned convolutional neural network architecture , author=. Computer Networks , volume=. 2020 , publisher=

2020
[37]

Engineering Applications of Artificial Intelligence , volume=

Image-based malware detection using convolutional neural network with autoencoder in Industrial Internet of Things , author=. Engineering Applications of Artificial Intelligence , volume=. 2024 , publisher=

2024
[38]

Information , volume=

Malware Classification Using Few-Shot Learning Approach , author=. Information , volume=. 2024 , publisher=

2024
[39]

Cybersecurity , volume=

Mi-MAML: Classifying few-shot advanced malware using multi-head meta-learning , author=. Cybersecurity , volume=. 2024 , publisher=

2024

Pith tools

Reviewed July 11, 2026 · model on record in the stance chip above.

[1] [1]

Machine Learning With Applications , volume=

A survey of malware detection using deep learning , author=. Machine Learning With Applications , volume=. 2024 , publisher=

2024

[2] [2]

VRL, ECE , volume=

Detecting packed executables based on raw binary data , author=. VRL, ECE , volume=

[3] [3]

Knowledge-Based Systems , volume=

CNN-LSTM and transfer learning models for malware classification based on opcodes and API calls , author=. Knowledge-Based Systems , volume=. 2024 , publisher=

2024

[4] [4]

Security in Computing and Communications: International Symposium, SSCC 2013, Mysore, India, August 22-24, 2013

Malware detection using API function frequency with ensemble based classifier , author=. Security in Computing and Communications: International Symposium, SSCC 2013, Mysore, India, August 22-24, 2013. Proceedings 1 , pages=. 2013 , organization=

2013

[5] [5]

2015 IEEE International Conference on Software Quality, Reliability and Security , pages=

Machine learning based hybrid behavior models for Android malware analysis , author=. 2015 IEEE International Conference on Software Quality, Reliability and Security , pages=. 2015 , organization=

2015

[6] [6]

Computers & Security , volume=

SynDroid: An adaptive enhanced Android malware classification method based on CTGAN-SVM , author=. Computers & Security , volume=. 2024 , publisher=

2024

[7] [7]

Proceedings of the 15th International Conference on Digital Image Processing , pages=

Dae-ihog: An improved method for classification malware , author=. Proceedings of the 15th International Conference on Digital Image Processing , pages=

[8] [8]

IEEE transactions on pattern analysis and machine intelligence , volume=

One-shot learning of object categories , author=. IEEE transactions on pattern analysis and machine intelligence , volume=. 2006 , publisher=

2006