Explainable Malware Detection System Using Transformers-Based Transfer Learning and Multi-Model Visual Representation

Farhan Ullah, Amjad Alsirhani, Mohammed Mujib Alshahrani, Abdullah Alomari, Hamad Naeem, Syed Aziz Shah

    Research output: Contribution to journalArticlepeer-review

    17 Citations (Scopus)
    58 Downloads (Pure)


    Android has become the leading mobile ecosystem because of its accessibility and adaptability. It has also become the primary target of widespread malicious apps. This situation needs the immediate implementation of an effective malware detection system. In this study, an explainable malware detection system was proposed using transfer learning and malware visual features. For effective malware detection, our technique leverages both textual and visual features. First, a pre-trained model called the Bidirectional Encoder Representations from Transformers (BERT) model was designed to extract the trained textual features. Second, the malware-to-image conversion algorithm was proposed to transform the network byte streams into a visual representation. In addition, the FAST (Features from Accelerated Segment Test) extractor and BRIEF (Binary Robust Independent Elementary Features) descriptor were used to efficiently extract and mark important features. Third, the trained and texture features were combined and balanced using the Synthetic Minority Over-Sampling (SMOTE) method; then, the CNN network was used to mine the deep features. The balanced features were then input into the ensemble model for efficient malware classification and detection. The proposed method was analyzed extensively using two public datasets, CICMalDroid 2020 and CIC-InvesAndMal2019. To explain and validate the proposed methodology, an interpretable artificial intelligence (AI) experiment was conducted.
    Original languageEnglish
    Article number6766
    Number of pages22
    Issue number18
    Early online date7 Sept 2022
    Publication statusPublished - 7 Sept 2022

    Bibliographical note

    This is an open access article distributed under the Creative Commons Attribution License which permits unrestricted use, distribution, and reproduction in any medium, provided the original work is properly cited.


    • malware analysis
    • transfer learning
    • malware visualization
    • explainable AI
    • cybersecurity
    • malicious
    • network behavior


    Dive into the research topics of 'Explainable Malware Detection System Using Transformers-Based Transfer Learning and Multi-Model Visual Representation'. Together they form a unique fingerprint.

    Cite this