CNN Architecture Comparison for Malware Classification with Limited Training Data

Traditional malware classification methods struggle to keep pace with rapidly evolving threats. Image-based malware classification offers a promising alternative by converting malware binaries into grayscale images for analysis with deep learning. While effective, organizations often face practical constraints in acquiring sufficient training data, especially for newer threats. This thesis investigates dual-path CNN architectures with intermediate feature fusion as a potential enhancement for malware classification, with particular focus on how varying training data size affects their comparative performance against traditional single-path approaches. This research implements and compares two models: a baseline single-path using the pre-trained VGG16 architecture and a dual-path model that combines VGG16 with a custom CNN through intermediate feature fusion. Both architectures are evaluated on a binary classification task distinguishing between two malware families (C2Lop.P trojan and Dialplatform.B worm) from the Malimg dataset. Each model is trained across four different training data proportions (20%, 40%, 60%, and 80%), with three training runs per size to ensure statistical robustness, while being evaluated on complementary test sets of varying sizes. Though both architectures achieved perfect classification performance across all training percentages, the study revealed significant differences in secondary metrics including training efficiency, robustness to noise perturbation, and architectural complexity. By systematically comparing these architectures under varying data constraints, this thesis contributes insights into the practical tradeoffs between architectural complexity and performance. The findings challenge common assumptions about complex architectures, demonstrating that simpler models can offer superior efficiency and robustness without sacrificing classification performance in image-based malware analysis.