Malware remains a primary threat in cybersecurity, used by cybercriminals to damage digital systems. In this work, we propose a novel malware classification pipeline that transforms raw executable files, even obfuscated ones, into structured data representations, namely graphs and grayscale images, suitable for deep learning models. Starting from real-world samples executed in a sandboxed environment, our method extracts opcodes from memory dumps and builds opcode transition graphs, which can be used directly or as the basis for image construction. With our prototype, we evaluate lightweight deep learning models on both representations, demonstrating that even with simple architectures and a limited dataset, our approach achieves promising results, particularly high precision, highlighting its potential for earlystage, automated malware triage.

Seeing Malware Differently: A Novel Signal-Based Graph and Image Approach to Detection / Bragaglia, R., Lazzeretti, R.. - (2025), pp. 7-12. (17th IEEE International Workshop on Information Forensics and Security, IEEE WIFS 2025 Perth; Australia ) [10.1109/wifs66636.2025.00010].

Seeing Malware Differently: A Novel Signal-Based Graph and Image Approach to Detection

Lazzeretti, Riccardo
2025

Abstract

Malware remains a primary threat in cybersecurity, used by cybercriminals to damage digital systems. In this work, we propose a novel malware classification pipeline that transforms raw executable files, even obfuscated ones, into structured data representations, namely graphs and grayscale images, suitable for deep learning models. Starting from real-world samples executed in a sandboxed environment, our method extracts opcodes from memory dumps and builds opcode transition graphs, which can be used directly or as the basis for image construction. With our prototype, we evaluate lightweight deep learning models on both representations, demonstrating that even with simple architectures and a limited dataset, our approach achieves promising results, particularly high precision, highlighting its potential for earlystage, automated malware triage.
2025
17th IEEE International Workshop on Information Forensics and Security, IEEE WIFS 2025
Deep Learning; Graph representation; Image representation; Malware classification
04 Pubblicazione in atti di convegno::04b Atto di convegno in volume
Seeing Malware Differently: A Novel Signal-Based Graph and Image Approach to Detection / Bragaglia, R., Lazzeretti, R.. - (2025), pp. 7-12. (17th IEEE International Workshop on Information Forensics and Security, IEEE WIFS 2025 Perth; Australia ) [10.1109/wifs66636.2025.00010].
File allegati a questo prodotto
File Dimensione Formato  
Bragaglia_Seeing-Malware-Differently_postprint_2026.pdf

solo gestori archivio

Tipologia: Documento in Post-print (versione successiva alla peer review e accettata per la pubblicazione)
Licenza: Tutti i diritti riservati (All rights reserved)
Dimensione 619.12 kB
Formato Adobe PDF
619.12 kB Adobe PDF   Contatta l'autore
Bragaglia_Seeing-Malware-Differently_2026.pdf

solo gestori archivio

Tipologia: Versione editoriale (versione pubblicata con il layout dell'editore)
Licenza: Tutti i diritti riservati (All rights reserved)
Dimensione 1.11 MB
Formato Adobe PDF
1.11 MB Adobe PDF   Contatta l'autore

I documenti in IRIS sono protetti da copyright e tutti i diritti sono riservati, salvo diversa indicazione.

Utilizza questo identificativo per citare o creare un link a questo documento: https://hdl.handle.net/11573/1770939
Citazioni
  • ???jsp.display-item.citation.pmc??? ND
  • Scopus 0
  • ???jsp.display-item.citation.isi??? ND
social impact