HilEnT: Hilbert, Entropy Transformed Image Based Malware Detection
2026-07-06 • Cryptography and Security
Cryptography and Security
AI summaryⓘ
The authors developed a new way to turn malware code into images using a method called HilEnT, which combines a Hilbert curve transformation and entropy comparisons. These images are made in three parts that together form a colored image, which can then be analyzed by machine learning to detect and classify malware. They tested their approach on several datasets and also tried it with limited data to see if it still works well. Additionally, they improved the speed of detection by using techniques to reduce the amount of data needed. Their method showed very good results compared to existing methods.
malware detectionHilbert curveentropyimage processingmachine learningfew-shot learningHistogram of Oriented GradientsPrincipal Component Analysisbinary classificationmulticlass classification
Authors
Rahul Kale, Thesath Wijayasiri, Kar Wai Fok, Vrizlynn L. L. Thing
Abstract
With the increasing threat of malware across various software related domains, malware detection and classification is critical to determine the response actions. Different strategies have been adopted to address the challenge of malware detection. With the advent of deep learning techniques, malware detection using image processing has garnered research attention. In this work, we proposed a novel malware binary to image transformation technique HilEnT based on a combination of Hilbert curve-based transformation of malware binary and the entropy feature comparison of malware file with benign and malware classes. Three grayscale images produced during this process are combined to form a three-channel colored image which is then used for malware detection using machine learning techniques. We performed supervised binary and multiclass classification to evaluate the effectiveness of our proposed HilEnT. We also evaluated a few-shot learning technique to assess the robustness of our proposed HilEnT in a practical setting where the number of available class samples is limited. Furthermore, we investigated the benefits of combination of Histogram of Oriented Gradients and Principal Component Analysis for time performance improvements through feature reduction techniques. We evaluated our proposed methodology on four datasets: Dike, Michael Lester Dataset, Microsoft BIG 2015 and a self-collected dataset, and achieved the state-of-the-art results.