Malware Dataset Research Articles

A multi-objectives framework for secure blockchain in fog–cloud network of vehicle-to-infrastructure applications

The Intelligent Transport System (ITS) is an emerging paradigm that offers numerous services at the infrastructure level for vehicle applications. Vehicle-to-infrastructure (V2I) is an advanced form of ITS where diverse vehicle services are deployed on the roadside unit. V2I consists of distributed computing nodes where transport applications are parallel processed. Many research challenges exist in the presented V2I paradigms regarding security, cyber-attacks, and application processing among heterogeneous nodes. These cyber-attacks, Sybil attacks, and their attempts cause a lack of security and degrade the V2I performance in the presented paradigms. This paper presents a new secure blockchain framework that handles cyber-attacks, as mentioned earlier. This paper formulates this complex problem as a combinatorial problem, encompassing concave and convex problems. The convex function minimizes the given constraints, such as time and security risk, and the concave function improves performance and accuracy. Therefore, numerous constraints, such as time, energy, malware detection accuracy, and application deadlines, require optimization for the considered problem. Combining the jointly non-dominated sorting genetic algorithm (NSGA-II) and long short-term memory (LSTM) schemes is the best way to meet the problem’s limitations. In this study, the paper designed a malware dataset with known and unknown malware. The different kinds of malware lists (e.g., cyber-attacks) are considered in the form of known and unknown malware lists with the characteristics, size of code, where malware comes from, attack on which data, and current status of the workload after being attacked by the malware. Our main idea is to present blockchain, NSGA-II, and LSTM schemes that handle phishing, routing, Sybil, and 51% of cyber-attacks without compromising application performance. Simulation results show that the study reduces delay and energy, improves accuracy, and minimizes security risks for vehicular applications.

AndroDex: Android Dex Images of Obfuscated Malware

With the emergence of technology and the usage of a large number of smart devices, cyber threats are increasing. Therefore, research studies have shifted their attention to detecting Android malware in recent years. As a result, a reliable and large-scale malware dataset is essential to build effective malware classifiers. In this paper, we have created AndroDex: an Android malware dataset containing a total of 24,746 samples that belong to more than 180 malware families. These samples are based on .dex images that truly reflect the characteristics of malware. To construct this dataset, we first downloaded the APKs of the malware, applied obfuscation techniques, and then converted them into images. We believe this dataset will significantly enhance a series of research studies, including Android malware detection and classification, and it will also boost deep learning classification efforts, among others. The main objective of creating images based on the Android dataset is to help other malware researchers better understand how malware works. Additionally, an important result of this study is that most malware nowadays employs obfuscation techniques to hide their malicious activities. However, malware images can overcome such issues. The main limitation of this dataset is that it contains images based on .dex files that are based on static analysis. However, dynamic analysis takes time, therefore, to overcome the issue of time and space this dataset can be used for the initial examination of any .apk files.

Broad learning: A GPU-free image-based malware classification

In today’s cybersecurity landscape, software security companies encounter a significant challenge in detecting new and unknown malware. Despite the introduction of various machine learning and deep learning tools designed to identify malicious software based on static and dynamic features, achieving the desired level of accuracy remains elusive. This challenge is exacerbated by factors such as encryption, packing, limited distribution, and uneven allocation of malware samples across different families. Moreover, deep learning techniques demand substantial time, computational resources (specifically GPUs), and expertise from data scientists for practical malware analysis. In response to these challenges, we propose a novel GPU-free approach called Image-based Malware Classification using Broad Learning (IMCBL) to address these issues. Our method integrates visualization, feature decomposition, and broad learning architecture to enhance malware detection and classification. We convert raw malware binaries into images, reducing the necessity for extensive feature engineering. These images transform using truncated Singular Value Decomposition (SVD) to reduce the feature vector size, expediting the training process while mitigating model overfitting. The transformed feature vector is then input into our proposed Broad Learning (BL) system, which facilitates malware detection and classification. The BL architecture, structured as a flat network mapping original inputs to feature nodes and expanding the structure in enhancement nodes, ensures efficient and effective classification without the need for retraining. This dynamic and incremental learning capability sets IMCBL apart, making it superior to existing deep learning architectures. To validate our approach, we conducted extensive experiments using five benchmark malware datasets, including the Microsoft Windows malware challenge dataset, the Malimg Windows malware dataset, the IoT-Android mobile malware dataset, the Big Windows malware dataset, and an obfuscated Windows malware dataset. The results demonstrate IMCBL’s remarkable success in classifying most malware samples, even under obfuscation attacks, performing comparably or outperforming current methods using similar benchmarks. Specifically, IMCBL achieved 95.58% accuracy for the Microsoft Windows malware dataset, 97.64% accuracy for the Malimg Windows malware dataset, 96.51% accuracy for IoT Android malware datasets, and 96.19% accuracy for the extensive Windows malware dataset. Additionally, IMCBL demonstrated 93.04% accuracy for an obfuscated Windows malware dataset, which contains both packed and unpacked malware samples. Notably, IMCBL exhibits an exponential advantage in computation overhead, including training and prediction time, when compared to traditional machine learning and advanced state-of-the-art deep learning architectures such as VGG16, ResNet50, and InceptionV3.

Using 3D-VGG-16 and 3D-Resnet-18 deep learning models and FABEMD techniques in the detection of malware

Currently, the detection of malware to prevent cybersecurity breaches is a raising a concern for millions of people around the globe. Even with the most recent updates, antivirus software can leave computer users vulnerable to malware threats and attacks due to the rapid release of new malware. As a result, conventional antivirus software is frequently incapable of identifying novel forms of malware until their unique signatures have been added to the software's database. To protect systems, there is necessity in the current technology field to develop innovative techniques for detecting unidentified malware, particularly during the initial phases of malware deployment. The objective is to address the issue of imbalanced and inadequate malware dataset through the utilization of the fast and adaptive bidirectional empirical mode decomposition (FABEMD) technique. While exploring the Malimg and MaleVis datasets, promising results were reached in reference to accuracy, precision, recall, and F1-score. The experiment demonstrated the accuracy of two distinct 3D architectures, namely 3D VGG-16 and 3D Resnet-18, on two separate datasets: Malimg dataset and MaleVis dataset. The accuracy achieved for VGG-16 was 96.14% and 98.60% for the Malimg and the MaleVis dataset, respectively. In regards to the Resnet-18 architecture, it demonstrated high accuracy rates of 99.64% and 99.46% for the Malimg and MaleVis datasets, respectively.

MAlign: Explainable static raw-byte based malware family classification using sequence alignment

For a long time, malware classification and analysis have been an arms-race between antivirus systems and malware authors. Though static analysis is vulnerable to evasion techniques, it is still popular as the first line of defense in antivirus systems. But most of the static analyzers failed to gain the trust of practitioners due to their black-box nature. We propose MAlign, a novel static malware family classification approach inspired by genome sequence alignment that can not only classify malware families but can also provide explanations for its decision. MAlign encodes raw bytes using nucleotides and adopts genome sequence alignment approaches to create a signature of a malware family based on the conserved code segments in that family, without any human labor or expertise. We evaluate MAlign on two malware datasets, and it outperforms other state-of-the-art machine learning-based malware classifiers (by 4.49%∼0.07%), especially on small datasets (by 19.48%∼1.2%). Furthermore, we explain the generated signatures by MAlign on different malware families illustrating the kinds of insights it can provide to analysts, and show its efficacy as an analysis tool. Additionally, we evaluate its theoretical and empirical robustness against some common attacks. In this paper, we approach static malware analysis from a unique perspective, aiming to strike a delicate balance among performance, interpretability, and robustness.

A malware detection model based on imbalanced heterogeneous graph embeddings

The proliferation of malware in recent years has posed a significant threat to the security of computers and mobile devices. Detecting malware, especially on the Android platform, has become a growing concern for researchers and the software industry. This paper proposes a new method for detecting Android malware based on unbalanced heterogeneous graph embedding. First of all, most malware datasets contain an imbalance of malicious and benign samples, since some types of malware are scarce and difficult to collect. Thus, as a result of this problem, the classification algorithm is unable to analyze the minority samples through sufficient data, resulting in poor downstream classifier performance, in light of the fact that adversarial generation networks possess the characteristic of completing data, an algorithm for generating graph structure data is presented, in which nodes are generated to simulate the distribution of minority nodes within a network topology. Then, considering that heterogeneous information networks have the characteristics of retaining rich node semantic features and mining implicit relationships, heterogeneous graphs are used to construct models for different types of entities (i.e. Apps, APIs, permissions, intents, etc.) and different meta-paths. Finally, a new method is introduced to alleviate the over-smoothing phenomenon of node information in the propagation of deep network. In the deep GCN, we first sample the leader nodes of each layer node, and then add a residual connection and an identity map in order to determine the characteristics of the high-order leader. In this paper, a self-attention-based semantic fusion method is also applied to adaptively fuse embedded representations of software nodes under different meta-paths. The test results demonstrate that the proposed IHODroid model effectively detects malicious software. In the DREBIN dataset, which consists of 123,453 Android applications and 5,560 malicious samples, the IHODroid model achieves an accuracy of 0.9360 and an F1 score of 0.9360, outperforming other state-of-the-art baseline methods.

IMCNN:Intelligent Malware Classification using Deep Convolution Neural Networks as Transfer learning and ensemble learning in honeypot enabled organizational network

Traditional malware detection systems based on signature-based detection methods cannot detect new and unseen malware. Moreover, conventional machine learning methods for malware detection have utilized features extracted through static program analysis or dynamic analysis, which requires code debugging and execution primarily through offline processing; hence not a scalable approach. This paper proposes a novel intelligent malware classification using a deep convolution neural network (IMCNN) in organizational networks enabled with Honeypots. Systematic customization of pre-trained convolutional neural networks(CNN) as a transfer learning and ensemble learning as a classification is presented to detect intelligent modern-day malware. Real-world malware samples are systematically labeled and visualized into grayscale images. Four cutting-edge deep CNN models - VGG16, VGG19, InceptionV3, and ResNet50, are trained on the ImageNet database (≥1 million) and fine-tuned as feature extractors along with a basic CNN model. Three strategies are designed for feature extraction and selection: Rectified linear unit (ReLU) fully connected layer embedded in a deep CNN model, principal component analysis (PCA), and singular value decomposition(SVD). Reduced sets of features are stacked and used to train k-nearest neighbor (k-NN), support vector machine (SVM), and random forest (RF) classifiers for predictions. Subsequently, the predictive probabilities of different machine-learned models are ensembled using a soft voting method for final classification. The proposed method is evaluated on MalImg datasets (9339 malware samples of 25 families) and real-world modern malware datasets (690 malware of 22 families). The experimental results reveal that despite using a reduced feature set, the IMCNN effectively detects malware with 99.36% test accuracy on unseen data for MalImg datasets and 92.11% for real-world malware. In addition, the proposed method is compared with several existing state-of-art malware detection models in terms of performance accuracy and found performing as the best. Experiments demonstrated that the proposed method is resilient to polymorphic code obfuscation used by the malware authors.

Multimodal Dual-Embedding Networks for Malware Open-Set Recognition.

Malware open-set recognition (MOSR) is an emerging research domain that aims at jointly classifying malware samples from known families and detecting the ones from novel unknown families, respectively. Existing works mostly rely on a well-trained classifier considering the predicted probabilities of each known family with a threshold-based detection to achieve the MOSR. However, our observation reveals that the feature distributions of malware samples are extremely similar to each other even between known and unknown families. Thus, the obtained classifier may produce overly high probabilities of testing unknown samples toward known families and degrade the model performance. In this article, we propose the multi \ modal dual-embedding networks, dubbed MDENet, to take advantage of comprehensive malware features from different modalities to enhance the diversity of malware feature space, which is more representative and discriminative for down-stream recognition. Concretely, we first generate a malware image for each observed sample based on their numeric features using our proposed numeric encoder with a re-designed multiscale CNN structure, which can better explore their statistical and spatial correlations. Besides, we propose to organize tokenized malware features into a sentence for each sample considering its behaviors and dynamics, and utilize language models as the textual encoder to transform it into a representable and computable textual vector. Such parallel multimodal encoders can fuse the above two components to enhance the feature diversity. Last, to further guarantee the open-set recognition (OSR), we dually embed the fused multimodal representation into one primary space and an associated sub-space, i.e., discriminative and exclusive spaces, with contrastive sampling and ρ -bounded enclosing sphere regularizations, which resort to classification and detection, respectively. Moreover, we also enrich our previously proposed large-scaled malware dataset MAL-100 with multimodal characteristics and contribute an improved version dubbed MAL-100 + . Experimental results on the widely used malware dataset Mailing and the proposed MAL-100 + demonstrate the effectiveness of our method.

Malware Classification Using Machine Learning Models

Malware, a form of harmful software, poses a significant threat to victims by compromising data integrity and facilitating unauthorized access. Analogous to the COVID virus’s impact on the human body, untreated malware can cause ongoing internal harm until system limits are exhausted. Before proceeding with any further steps in our research, a crucial initial task is to explore various types of benchmark malware datasets. To address the challenge of malware dataset selection a comprehensive search for benchmark datasets conducted and selected CIC-MalMem-2022 dataset. Our dataset included 29,298 samples encompassing various malware families and benign instances. The proposed framework uses six different types of machine learning algorithms, namely Logistic Regression, Support Vector Machine, K-Nearest Neighbor, Random Forest, Naive Bayes, and Decision Tree for the classification of malware. Correlation based feature selection approach is used with a threshold value of 0.6 to identify the most important features and eliminate redundant and irrelevant features. The six models were cross-validated by 10-fold cross validation method. After evaluating the ML models using different classifiers, considering metrics such as accuracy, precision, recall, and F1-score, it was evident that the Decision Tree model outperformed the others. The achieved classification metrics for accuracy, precision, recall, and F1-score were as follows: 0.9994240, 0.9996162, 0.9992325, and 0.9994882, respectively. However, in the testing phase, the Decision Tree and KNN classifiers exhibited comparable performance, with both achieving an accuracy of 0. 9998293.These outcomes demonstrate the model’s ability in identifying and categorizing malware, thereby contributing to enhanced data security.

Customized K-nearest neighbors’ algorithm for malware detection

The security and integrity of computer systems and networks highly depend on malware detection. In the realm of malware detection, the K-Nearest Neighbors (KNN) algorithm is a well-liked and successful machine learning algorithm. However, the choice of an acceptable distance metric parameter has a significant impact on the KNN algorithm's performance. This study tries to improve malware detection by adjusting the KNN algorithm's distance metric parameter. The distance metric greatly influences the similarity or dissimilarity between instances in the feature space. The KNN algorithm for malware detection can be more accurate and effective by carefully choosing or modifying the distance metric. This paper analyzes multiple distance metrics, including Minkowski distance, Manhattan distance, and Euclidean distance. These metrics account for the traits of malware samples while capturing various aspects of similarity. The effectiveness of the KNN algorithm is evaluated using the MalMem-2022 malware dataset, and the results are broken down into these three-distance metrics. The experimental findings show that, among the three distance metric parameters, the Euclidean and Minkowski distance metric parameters considerably produced the best outcomes with binary classification. While with multiclass classification, the KNN algorithm has achieved the highest outcomes using Manhattan distance.

Multi-label Classification for Android Malware Based on Active Learning

The existing malware classification approaches (i.e., binary and family classification) can barely benefit subsequent analysis with their outputs. Even the family classification approaches suffer from lacking a formal naming standard and an incomplete definition of malicious behaviors. More importantly, the existing approaches are powerless for one malware with multiple malicious behaviors, while this is a very common phenomenon for Android malware in the wild. So that both of them actually cannot provide researchers with a direct and comprehensive enough understanding of malware. In this paper, we propose MLCDroid, an ML-based multi-label classification approach that can directly indicate the existence of pre-defined malicious behaviors. With an in-depth analysis, we summarize 6 basic malicious behaviors from real-world malware with security reports and construct a labeled dataset. We compare the results of 70 algorithm combinations to evaluate the effectiveness (best at 73.3%). Faced with the challenge of the expensive cost of data annotation, we further propose an active learning approach based on data augmentation, which can improve the overall accuracy to 86.7% with a data augmentation of 5,000+ high-quality samples from an unlabeled malware dataset. This is the first multi-label Android malware classification approach intending to provide more information on fine-grained malicious behaviors.

APTracker: A Comprehensive and Analytical Malware Dataset, Based on Attribution to APT Groups

APTracker: A Comprehensive and Analytical Malware Dataset, Based on Attribution to APT Groups

Employing combined spatial and frequency domain image features for machine learning-based malware detection

<p>The ubiquitous adoption of Android devices has unfortunately brought a surge in malware threats, compromising user data, privacy concerns, and financial and device integrity, to name a few. To combat this, numerous efforts have explored automated botnet detection mechanisms, with anomaly-based approaches leveraging machine learning (ML) gaining attraction due to their signature-agnostic nature. However, the problem lies in devising accurate ML models which capture the ever evolving landscape of malwares by effectively leveraging all the possible features from Android application packages (APKs).This paper delved into this domain by proposing, implementing, and evaluating an image-based Android malware detection (AMD) framework that harnessed the power of feature hybridization. The core idea of this framework was the conversion of text-based data extracted from Android APKs into grayscale images. The novelty aspect of this work lied in the unique image feature extraction strategies and their subsequent hybridization to achieve accurate malware classification using ML models. More specifically, four distinct feature extraction methodologies, namely, Texture and histogram of oriented gradients (HOG) from spatial domain, and discrete wavelet transform (DWT) and Gabor from the frequency domain were employed to hybridize the features for improved malware identification. To this end, three image-based datasets, namely, Dex, Manifest, and Composite, derived from the information security centre of excellence (ISCX) Android Malware dataset, were leveraged to evaluate the optimal data source for botnet classification. Popular ML classifiers, including naive Bayes (NB), multilayer perceptron (MLP), support vector machine (SVM), and random forest (RF), were employed for the classification task. The experimental results demonstrated the efficacy of the proposed framework, achieving a peak classification accuracy of 93.03% and recall of 97.1% for the RF classifier using the Manifest dataset and a combination of Texture and HOG features. These findings validate the proof-of-concept and provide valuable insights for researchers exploring ML/deep learning (DL) approaches in the domain of AMD.</p>

A machine learning technique for Android malicious attacks detection based on API calls

Android malware is widespread and it is considered as one of the most threatening attacks recently. The threat is targeting to damage access data or information or leaking them; in general, malicious software consists of viruses, worms, and other malware. Current malware attempts to prevent being detected by any software or anti-virus. This paper describes recent Android malware detection static and interactive approaches as well as several open-source malware datasets. The paper also examines the most current state-of-the-art Android malware identification techniques including identifying by comparative evaluation the gaps between these techniques. As a result, an API-based dynamic malware detection framework is proposed for Android to provide a dynamic paradigm for malware detection. The proposed framework was closely inspected and checked for reliability where meaningful API packages and methods were discovered.

Detection of Malware Attacks using Artificial Neural Network

Malware attacks are increasing rapidly as the technology continues to become prevalent. These attacks have become extremely difficult to detect as they continuously change their mechanism for exploitation of vulnerabilities in software. The conventional approaches to malware detection become ineffective due to a large number of varying patterns and sequences, thereby requiring artificial intelligence-based approaches for the detection of malware attacks. In this paper, we propose an artificial neural network-based model for malware detection. Our proposed model is generic as it can be applied to multiple datasets. We have compared our model with different machine-learning approaches. The experimentation results show that the proposed model can outperform other well-known approach as it achieves 99.6\% , 98.9\% and 99.9\% accuracy on the Windows API call dataset, Top PE Imports Dataset and Malware Dataset, respectively.

An empirical study of problems and evaluation of IoT malware classification label sources

With the proliferation of malware on IoT devices, research on IoT malicious code has also become more mature. Most studies use learning models to detect or classify malware. Therefore, ensuring high-quality labels for malware samples is crucial to maintaining research accuracy. Researchers typically submit malware samples to Anti-Virus (AV) engines to obtain labels, but different engines have varying rules for detecting maliciousness and variants. This study aims to improve future IoT malware research accuracy by investigating label quality. We address three label-related issues, including Anti-Virus detection technology, naming rules, and label expiration. Additionally, we examine multiple sources of malware labels, including 63 studies on IoT, Windows, and Android malware, as well as commonly used tools such as AVClass and Anti-Virus engines. To evaluate and recommend label sources, we construct classification models using an IoT malware dataset obtained from VirusShare, which is labeled with common tools and Anti-Virus engines and classified based on ELF features. For family classification, we investigate four methods and tools, and for variant hierarchy classification, we compare label overlaps with sample clustering from 12 Anti-Virus engines. Based on our findings, we recommend AVClass for obtaining labels for IoT family classification. For small-scale malware families at the variant level, we recommend using the labels from Ad-Aware, BitDefender, and Emsisoft engines. For large-scale malware families, we advise employing labels from Jiangmin, NANO-Antivirus, and Avira engines, serving as a valuable guide for future IoT malware research.

Android-manifest extraction and labeling method for malware compilation and dataset creation

<div align="center"><span lang="EN-US">Malware is a nuisance for smartphone users. The impact is detrimental to smartphone users if the smartphone is infected by malware. Malware identification is not an easy process for ordinary users due to its deeply concealed dangers in application package kit (APK) files available in the Android Play Store. In this paper, the challenges of creating malware datasets are discussed. Long before a malware classification process and model can be built, the need for datasets with representative features for most types of <span>malwares has to be addressed systematically. Only after a quality data set is available can a quality classification model be obtained using machine learning (ML) or deep learning (DL) algorithms. The entire malware classification process is</span> a full pipeline process and sub processes. The authors purposefully focus on the process of building quality malware datasets, not on ML itself, because implementing ML requires another effort after the reliable dataset is fully built. The overall step in creating the malware dataset starts with the extraction of the Android Manifest from the APK file set and ends with the labeling method for all the extracted APK files. The key contribution of this paper is on how to generate datasets systematically from any APK file.</span></div>

A review of deep learning models to detect malware in Android applications

Android applications are indispensable resources that facilitate communication, health monitoring, planning, data sharing and synchronization, social interaction, business and financial transactions. However, the rapid increase in the smartphone penetration rate has consequently led to an increase in cyberattacks. Smartphone applications use permissions to allow users to utilize different functionalities, making them susceptible to malicious software (malware). Despite the rise in Android applications’ usage and cyberattacks, the use of deep learning (DL) models to detect emerging malware in Android applications is still nascent. Therefore, this review sought to explain DL models that are applied to detect malware in Android applications, explore their performance as well as identify emerging research gaps and present recommendations for future work. This study adopted the preferred reporting items for systematic reviews and meta-analyses (PRISMA) guidelines to guide the review. The study revealed that convolutional neural networks, gated recurrent neural networks, deep neural networks, bidirectional long short-term memory, long short-term memory (LSTM) and cubic-LSTM are the most prominent deep learning-based malicious software detection models in Android applications. The findings show that deep learning models are increasingly becoming an effective technique for malicious software detection in Android applications in real-time. However, monitoring and tracking information flow and malware behavior is a daunting task because of the evolving nature of malware and human behavior. Therefore, training mobile application users and sharing updated malware datasets is paramount in developing detection models. There is also a need to detect malicious software before downloading mobile applications to improve the security of Android smartphones.

A privacy-preserving federated learning with a secure collaborative for malware detection models using Internet of Things resources

The rise in malware attacks presents a growing security threat in today’s digital landscape, emphasizing the need for advanced malware detection methodology. While numerous detection systems utilizing methodologies like machine learning (ML) have been developed, they often fail to detect new and unknown malware in real time. This is because their malware datasets are generated with a very limited source and are not dynamic for up-to-date malware. Thus, with of the growth of the Internet of Things, malware have also increasingly grown, which makes current malware detection systems outdated in a short time. Therefore, IoT device resources can be exploited for building malware datasets having various types of malware families. In addition, the approach of collecting data from IoT devices and training them in a centralized cloud (CC) server is no longer acceptable due to this approach incurs significant security and privacy issues. This paper proposes PPFL-SC, an efficient privacy-preserving federated learning with a secure collaborative supporting verification. A group-oblivious signcryption cryptography is designed to be used as a privacy-preserving technique for federated learning. The CC server aggregates data without compromising individual data privacy. Moreover, the Stackelberg incentive model is designed as an incentive mechanism for encouraging IoT devices to collaborate through their heterogeneous dataset in a malware detection model. Thus, the proposed incentive mechanism is capable of increasing the participation of IoT devices and decreasing their dropping out during model updating. A security analysis confirms that PPFL-SC fulfills all security requirements for privacy-preserving federated learning. Real-world dataset experiments validate the efficiency and practicality of the proposed PPFL-SC.

Android Malware Classification Based on Fuzzy Hashing Visualization

The proliferation of Android-based devices has brought about an unprecedented surge in mobile application usage, making the Android ecosystem a prime target for cybercriminals. In this paper, a new method for Android malware classification is proposed. The method implements a convolutional neural network for malware classification using images. The research presents a novel approach to transforming the Android Application Package (APK) into a grayscale image. The image creation utilizes natural language processing techniques for text cleaning, extraction, and fuzzy hashing to represent the decompiled code from the APK in a set of hashes after preprocessing, where the image is composed of n fuzzy hashes that represent an APK. The method was tested on an Android malware dataset with 15,493 samples of five malware types. The proposed method showed an increase in accuracy compared to others in the literature, achieving up to 98.24% in the classification task.