【摘要】 为了解决现有恶意软件分类方法在对抗检测能力和模型训练成本方面的不足，提出了一种基于迁移学习技术的轻量级恶意软件分类模型——MalDTL。将恶意软件的二进制文件转换为包含字节和信息熵特征的224×224的RGB图像。根据Windows操作系统的PE文件格式规范，在生成的RGB图像上附加标签框，形成RGBB图像。基于准确率、召回率、精确率和F1值，比较了VGG16、VGG19、InceptionV3和ResNet50这4种模型，选择ResNet50作为基准模型来构建MalDTL。实验结果表明，该模型在控制成本的同时，显著提高了恶意软件分类的准确性和对抗检测能力。更多还原

【Abstract】 To address the limitations of existing malware classification methods regarding adversarial detection capabilities and model training costs, a lightweight malware classification model based on transfer learning technology named MalDTL was proposed. The binary files of the malware were converted into 224×224 RGB images, incorporating byte and information entropy features. According to the PE file format specification for the Windows operating system, label boxes were added to these RGB images to create RGBB images. Based on the metrics of accuracy, recall, precision, and F1-score, four models—VGG16, VGG19, InceptionV3, and ResNet50—were compared, and ResNet50 was selected as the baseline model for constructing MalDTL. Experimental results demonstrate that the proposed model significantly enhances the accuracy of malware classification and adversarial detection capabilities while maintaining cost-effectiveness.更多还原