Visualization of binary files and machine learning methods in the detection and classification of malicious software
(Wizualizacja plików binarnych i metody uczenia maszynowego w detekcji i klasyfikacji złośliwego oprogramowania)
More details
Hide details
1
Zakład Cyberbezpieczeństwa,
Instytut Telekomunikacji i Cyberbezpieczeństwa,
Wydział Elektroniki i Technik Informacyjnych, Politechnika Warszawska, Poland
Submission date: 2025-12-10
Acceptance date: 2025-12-22
Publication date: 2025-12-23
Corresponding author
Katarzyna Hanna Kaminska
Zakład Cyberbezpieczeństwa,
Instytut Telekomunikacji i Cyberbezpieczeństwa,
Wydział Elektroniki i Technik Informacyjnych, Politechnika Warszawska, Nowowiejska 15/19, 00-665, Warszawa, Poland
Cybersecurity and Law 2025;14(2):208-218
KEYWORDS
TOPICS
ABSTRACT
Objectives:
In recent years, there has been significant development in malware analysis methods that leverage machine learning- approaches that are becoming essential given the growing complexity of modern threats. Traditional methods, based on signature analysis or the extraction of features from source code, are proving increasingly ineffective against the obfuscation, polymorphism, and encryption techniques employed by malware authors. In response to these challenges, the concept of binary file visualization has emerged; it involves transforming the byte structure of files into images, which can then be analyzed using image processing algorithms and machine learning techniques.
Methods:
This approach enables the identification of patterns and relationships that are difficult to capture using traditional methods, while also allowing solutions developed in the field of computer-based image recognition to be applied to the analysis of malicious software.
Results:
This article provides an overview of key visualization methods - including grayscale imaging, color representations, and entropy-based visualizations - and discusses their applications in detection and classification tasks. Particular attention is given to machine learning models used for the analysis of images derived from binary files.
Conclusions:
The concluding section outlines both the primary advantages of this approach - such as its resilience against certain forms of obfuscation, the capability for automated feature extraction, and scalability - as well as its key limitations, including the loss of semantic information and the vulnerability of models to data variability. Furthermore, potential avenues for future research are presented, such as the development of multimodal methods and continuous learning, which could enhance the effectiveness and robustness of visualization-based detection systems.