How Heatmaps Turn Malware Reports into Super-Accurate Classifications?

Identifying the family a malware belongs to is one of cybersecurity's toughest puzzles. Many studies rely on random data splits, which inflate results: once deployed, malware behavior drifts and accuracy drops. To tackle this, researchers built a “leakage‑aware” pipeline that turns CAPEv2 sandbox JSON reports into visual heatmaps. Each row of the heatmap represents a behavioral key (e.g., file creation, network calls) and values are normalized to highlight the most frequent actions.

They tested several models – Random Forest, MLP, CNN64, HybridNet and ResNeXt‑50 – using both stratified (family‑balanced) and chronological (time‑ordered) splits. On the Avast‑CTU dataset with ten malware families, Random Forest reached 97.2 % accuracy and a 0.993 AUC, proving fast on CPUs. ResNeXt‑50 outperformed all with 98.4 % accuracy and a 0.998 AUC, also providing Grad‑CAM maps that reveal which heatmap regions drove the decision.

Beyond performance, the study measured inference speed and GPU memory use, and examined how vocabulary size and key selection affect results. The findings confirm that while ensemble methods stay robust, heatmap‑based CNNs deliver higher accuracy, interpretability and resistance to temporal drift, making them a promising choice for real‑time triage systems.

The transformation pipeline starts by extracting all key fields from the CAPEv2 JSON, such as "behavior", "network", "file" and "registry". These fields are flattened into a tabular structure where each column corresponds to a specific action (e.g., "create_file", "open_socket"). To handle sparsity, a minimum frequency threshold removes rare keys that would add noise. Numerical values (occurrence count, duration, size) are normalized using Z‑score to preserve a Gaussian distribution, while categorical variables (file type, protocol) are one‑hot encoded. The resulting matrix is resized to a 64×64 pixel image, where pixel intensity reflects the normalized strength of the corresponding activity.

For evaluation, chronological splits are built by ordering samples by collection date and dividing them into training (70 %), validation (15 %) and test (15 %). This simulates temporal drift, forcing the model to generalize to unseen behaviors. The Random Forest uses 500 trees with "gini" criterion and a maximum depth of 30, while ResNeXt‑50 is pretrained on ImageNet and fine‑tuned for 30 epochs with a 0.001 learning rate and data augmentation (random crop, horizontal flip). Grad‑CAM is computed on the final convolutional block, highlighting the most influential heatmap regions. The ablation study shows that reducing the vocabulary from 10 000 to 2 000 terms drops AUC by ~0.02, underscoring the importance of a rich behavioral representation.