Family Space Dynamic Reweighting for Malware Classification

Malware detection and classification have emerged as a prominent research area in the field of network security. In recent years, machine learning, large language models, and multimodal detection technologies have been widely applied to this field. However, the long-tail distribution of malware samples, with a few dominant classes and many underrepresented ones, significantly impairs the classification performance of machine learning models in malware detection. In this paper, we propose a novel family space dynamic reweighting classification method (FSDR), which dynamically reweights the classifiers by analyzing the spanned space of the family. We meticulously evaluate the magnitude of the spanned space for each category by conducting a thorough analysis of the sample distribution. By treating samples of a class as identically distributed random variables and analyzing their correlations, we derive a simple non-parametric formula to estimate the spanned space of a family. Subsequently, we apply a simple weighting scheme that is inversely proportional to the size of the spanned space for each family, aiming to achieve a more equitable training process. During the training, the weights of the family categories adaptively adjust as the optimized features evolve. The extensive experiments conducted on two widely-used datasets, Malimg and MaleVis, conclusively demonstrate the effectiveness and superiority of the proposed FSDR method. The code is available here<sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">1</sup>.