Journal Article

Mobile malware detection method using improved GhostNetV2 with image enhancement technique

Cui, MengTian, Du, Yao, Chen, Xi, Ning, AoJi, Gao, CaiXia, Xu, LiLi

2025

Overview

In recent years, image-based feature extraction and deep learning classification methods are widely used in the field of malware detection, which helps improve the efficiency of automatic malicious feature extraction and enhances the overall performance of detection models. However, recent studies reveal that adversarial sample generation techniques pose significant challenges to malware detection models, as their effectiveness significantly declines when identifying adversarial samples. To address this problem, we propose a malware detection method based on an improved GhostNetV2 model, which simultaneously enhances detection performance for both normal malware and adversarial samples. First, Android classes.dex files are converted into RGB images, and image enhancement is performed using the Local Histogram Equalization technique. Subsequently, the Gabor method is employed to transform three-channel images into single-channel images, ensuring consistent detection accuracy for malicious code while reducing training and inference time. Second, we make three improvements to GhostNetV2 to more effectively identify malicious code, including introducing channel shuffling in the Ghost module, replacing the squeeze and excitation mechanism with a more efficient channel attention mechanism, and optimizing the activation function. Finally, extensive experiments are conducted to evaluate the proposed method. Results demonstrate that our model achieves superior performance compared to 20 state-of-the-art deep learning models, attaining detection accuracies of 97.7% for normal malware and 92.0% for adversarial samples.

• Publisher: Nature Publishing Group,Nature Publishing Group UK,Nature Portfolio
• Subject: Accuracy / Adversarial samples / Algorithms / Classification / Deep learning / Efficiency / Image enhancement / Improved GhostNetV2 / Malware / Malware detection / Methods / Neural networks / Ransomware / Support vector machines