[Paper Review] Improving Malware Detection Accuracy by Extracting Icon Information

Pedro Silva, Sepehr Akhavan-Masouleh+1 more|arXiv (Cornell University)|Dec 10, 2017

Advanced Malware Detection Techniques17 references3 citations

TL;DR

This paper proposes enhancing malware detection in Portable Executable (PE) files by extracting and clustering icon features to improve machine learning model accuracy. It combines manually engineered features, histogram of gradients (HOG), and convolutional autoencoders to extract 1,114 features from icons, then clusters them into a single informative feature. Experiments show a 10% average accuracy increase in malware detection when icon clusters are included in prediction models.

ABSTRACT

Detecting PE malware files is now commonly approached using statistical and machine learning models. While these models commonly use features extracted from the structure of PE files, we propose that icons from these files can also help better predict malware. We propose an innovative machine learning approach to extract information from icons. Our proposed approach consists of two steps: 1) extracting icon features using summary statics, histogram of gradients (HOG), and a convolutional autoencoder, 2) clustering icons based on the extracted icon features. Using publicly available data and by using machine learning experiments, we show our proposed icon clusters significantly boost the efficacy of malware prediction models. In particular, our experiments show an average accuracy increase of 10% when icon clusters are used in the prediction model.

Motivation & Objective

• Address the underutilization of icon metadata in PE file malware detection, despite its potential to reveal malicious patterns.
• Overcome limitations of raw pixel-based icon analysis, which is vulnerable to subtle perturbations used by malware to evade detection.
• Develop a robust feature extraction pipeline that preserves meaningful visual information while resisting common icon obfuscations like blurring and color shifting.
• Demonstrate that icon clustering can serve as a powerful, low-dimensional feature that enhances the performance of machine learning-based malware classifiers.
• Validate the effectiveness of icon-based features through rigorous experiments using publicly available datasets and multiple classification models.

Proposed method

• Extract icon features using three complementary techniques: manually created (MC) features based on mean and standard deviation across RGB channels and image regions, histogram of oriented gradients (HOG) for shape and texture, and a convolutional autoencoder for deep feature learning.
• Combine the 1,114 extracted features into a unified feature vector per icon to represent its visual characteristics robustly against minor distortions.
• Apply clustering (k-means) to the combined feature vectors to group visually similar icons into discrete clusters, reducing dimensionality to a single categorical feature per file.
• Integrate the resulting icon cluster ID as a new feature into traditional machine learning models (logistic regression with L1/L2 regularization and linear SVM).
• Use stratified 4-fold cross-validation with hyperparameter tuning (regularization strength α) to optimize model performance and prevent overfitting.
• Evaluate models on a held-out test set using standard metrics: accuracy, true positive rate (TPR), true negative rate (TNR), and AUC, with statistical significance assessed via standard errors.

Experimental results

Research questions

• RQ1 Can icon features extracted from PE files improve the accuracy of machine learning-based malware detection models?
• RQ2 How effective are combined feature extraction techniques—manually created features, HOG, and autoencoders—in capturing meaningful visual patterns from icons while resisting common obfuscation techniques?
• RQ3 Does clustering icon features into semantic groups enhance the predictive power of malware detection models compared to using raw features or no icon information?
• RQ4 To what extent does the inclusion of icon cluster information improve model performance across different classifiers (e.g., logistic regression, SVM) and evaluation metrics (e.g., AUC, TPR, TNR)?
• RQ5 Is the improvement in detection accuracy statistically significant and consistent across multiple model architectures and evaluation protocols?

Key findings

• The inclusion of icon cluster features increased the average detection accuracy of malware prediction models by 10% compared to models without icon features.
• All three tested models—lasso logistic regression (LR L1), ridge logistic regression (LR L2), and linear SVM—showed consistent improvements in test accuracy, AUC, TPR, and TNR when icon cluster IDs were added.
• The best-performing model (LR L1 with icon clusters) achieved a test accuracy of 84.4%, a TPR of 80.2%, a TNR of 88.6%, and an AUC of 0.918, significantly outperforming the same model without icon features.
• The ROC curves in Figure 4 demonstrate a clear separation between models with and without icon cluster features, confirming the robustness and consistency of the improvement.
• The cross-validation and test set results show that the improvement is not due to overfitting, as regularization and stratified sampling were used to ensure generalization.
• The results indicate that icon information, though often ignored, contains meaningful, discriminative patterns that are highly relevant for malware detection when properly extracted and clustered.