[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"doc-detail-83848-en":3,"doc-seo-83848-105":29,"detail-sidebar-cat-0-en-105":91},{"code":4,"msg":5,"data":6},0,"success",{"doc_id":7,"user_id":8,"nickname":9,"user_avatar":10,"doc_module":4,"category_id":11,"category_name":12,"doc_title":13,"doc_description":14,"doc_content":15,"file_id":16,"file_url":17,"file_type":18,"file_size":19,"view_count":20,"is_deleted":4,"is_public":20,"is_downloadable":20,"audit_status":20,"page_count":21,"language":22,"language_code":23,"site_id":24,"html_lang":23,"table_of_contents":25,"faqs":26,"seo_title":13,"seo_description":14,"update_tm":27,"read_time":28},83848,8796095462418,"Noah","https://ap-avatar.wpscdn.com/avatar/80000253c1241d02b47?x-image-process=image/resize,m_fixed,w_180,h_180&k=1778826106357471780",8,"Research & Report","HilEnT: Hilbert, Entropy Transformed Image Based Malware Detection","Malware detection and classification are critical as malware threats expand across software and can evade signature- and training-based defenses. This paper proposes HilEnT, a malware binary-to-image transformation technique that applies Hilbert-curve transformation and entropy feature comparisons between benign and malware classes. Three grayscale images are merged into a three-channel colored image for machine-learning detection. The approach is evaluated via supervised binary and multiclass classification, plus few-shot learning robustness under limited labeled samples, and includes HOG+PCA for faster feature processing. Results reach state of the art on four datasets.","arXiv :2607 .04772v 1 [ cs .CR] 6 Jul 2026  \nHilEnT: Hilbert, Entropy Transformed Image Based  \nMalware Detection  \nRahul Kale, Thesath Wijayasiri, Kar Wai Fok, Vrizlynn L. L. Thing Cybersecurity Strategic Technology Centre, ST Engineering, Singapore.  \n*Corresponding author(s). E-mail(s): [rahulvishwanath.kale@stengg.com](rahulvishwanath.kale@stengg.com) ; Contributing authors: [boperachchigethesathguwantha.wijayasiri@stengg.com](boperachchigethesathguwantha.wijayasiri@stengg.com) ;  \n[fok.karwai@stengg.com](fok.karwai@stengg.com) ; [vriz@ieee.org](vriz@ieee.org) ;  \nAbstract  \nWith the increasing threat of malware across various software related domains, malware detection and classification is critical to determine the response actions. Different strategies have been adopted to address the challenge of malware detection. With the advent of deep learning techniques, malware detection using image processing has garnered research attention. In this work, we proposed a novel malware binary to image transformation technique HilEnT based on a combination of Hilbert curve based transformation of malware binary and the entropy feature comparison of malware file with benign and malware classes. Three grayscale images produced during this process are combined to form a three-channel colored image which is then used for malware detection using machine learning techniques. We performed supervised binary and multiclass classification to evaluate the effectiveness of our proposed HilEnT. We also evaluated a few-shot learning technique to assess the robustness of our proposed HilEnT in a practical setting where the number of available class samples is limited. Furthermore, we investigated the benefits of combination of Histogram of Oriented Gradientsand Principal Component Analysis for time performance improvements through feature reduction techniques. We evaluated our proposed methodology on four datasets: Dike, Michael Lester Dataset, MicrosoftBIG 2015 and a self-collected dataset, and achieved the state-of-the-art results.  \nKeywords: Malware Detection, Machine Learning, Malware Classification, Neural Network  \n1 Introduction  \nMalicious Software (Malware) has been an evergrowing problem in software-dependent industries as they can potentially infect various computing and networking devices. According to a survey (Bensaoud et al. 2024) published recently in 2024,  \nthe number of new vulnerabilities is still increasing every month in the year 2024 . As the malware detection systems are developed based on the existing available malware, new malware designed by attackers may evade detection on such detection systems. With such a large number of large  \nmonthly additions, distinguishing and classifying different types of malware is crucial to determine the response actions for safeguarding the systems under attack. This process also assists in identifying their potential impacts on the system and selecting a defense mechanism for protection against them.  \nDifferent malware detection approaches (Nataraj et al. 2010; Bensaoud and Kalita 2024; Natani and Vidyarthi 2013; Chuang and Wang 2015; Li et al. 2024; Wang and Li 2023) have been explored in the literature. In practical applications, most of the network traffic is generally benign. With the constantly evolving nature of the malware, it is generally difficult to obtain large number of malware samples of each class for thorough training of supervised malware classification algorithms. However, obtaining a few labeled anomaly samples is comparatively less expensive and more practical. With few-shot detection approach, the limited labeled data is leveraged for effective malware classification. This can be achieved either by fine-tuning the pre-existing models with handful of labeled data or by performing data augmentation of existing data. Additionally, these models can potentially be used for detecting unknown classes not used/seen during training. Some recent works (Hsiao et al. 2019; Bai ","cbCainHAU7hiJXBY","https://ap.wps.com/l/cbCainHAU7hiJXBY","pdf",783062,1,31,"English","en",105,"# Abstract\n# Keywords\n# 1 Introduction","[{\"question\":\"What is HilEnT and how does it transform malware for detection?\",\"answer\":\"HilEnT converts malware binaries into images using Hilbert-curve transformation, then applies entropy-based cutoff comparisons for benign and malware classes. The resulting grayscale images are combined into a three-channel image for machine-learning detection.\"},{\"question\":\"How are supervised binary and multiclass classification used in the evaluation?\",\"answer\":\"The paper evaluates HilEnT using supervised binary classification and multiclass classification to measure the effectiveness of the proposed malware-image representation and detection pipeline.\"},{\"question\":\"How does the method address real-world scenarios with limited labeled data?\",\"answer\":\"A few-shot learning evaluation is conducted to test robustness when the number of available samples per class is limited, making it more practical for supervised malware classification.\"}]",1784190963,78,{"code":4,"msg":30,"data":31},"ok",{"site_id":24,"language":23,"slug":32,"title":13,"keywords":33,"description":14,"schema_data":34,"social_meta":86,"head_meta":88,"extra_data":90,"updated_unix":27},"hilent-hilbert-entropy-transformed-image-based-malware-detection","",{"@graph":35,"@context":85},[36,53,68],{"@type":37,"itemListElement":38},"BreadcrumbList",[39,43,47,50],{"item":40,"name":41,"@type":42,"position":20},"https://docshare.wps.com","Home","ListItem",{"item":44,"name":45,"@type":42,"position":46},"https://docshare.wps.com/document/","Document",2,{"item":48,"name":12,"@type":42,"position":49},"https://docshare.wps.com/document/research-report/",3,{"item":51,"name":13,"@type":42,"position":52},"https://docshare.wps.com/document/hilent-hilbert-entropy-transformed-image-based-malware-detection/83848/",4,{"url":51,"name":13,"@type":54,"author":55,"headline":13,"publisher":57,"fileFormat":60,"inLanguage":23,"description":14,"dateModified":61,"datePublished":62,"encodingFormat":60,"isAccessibleForFree":63,"interactionStatistic":64},"DigitalDocument",{"name":9,"@type":56},"Person",{"url":40,"name":58,"@type":59},"DocShare","Organization","application/pdf","2026-07-17","2026-07-16",true,{"@type":65,"interactionType":66,"userInteractionCount":20},"InteractionCounter",{"@type":67},"ViewAction",{"@type":69,"mainEntity":70},"FAQPage",[71,77,81],{"name":72,"@type":73,"acceptedAnswer":74},"What is HilEnT and how does it transform malware for detection?","Question",{"text":75,"@type":76},"HilEnT converts malware binaries into images using Hilbert-curve transformation, then applies entropy-based cutoff comparisons for benign and malware classes. The resulting grayscale images are combined into a three-channel image for machine-learning detection.","Answer",{"name":78,"@type":73,"acceptedAnswer":79},"How are supervised binary and multiclass classification used in the evaluation?",{"text":80,"@type":76},"The paper evaluates HilEnT using supervised binary classification and multiclass classification to measure the effectiveness of the proposed malware-image representation and detection pipeline.",{"name":82,"@type":73,"acceptedAnswer":83},"How does the method address real-world scenarios with limited labeled data?",{"text":84,"@type":76},"A few-shot learning evaluation is conducted to test robustness when the number of available samples per class is limited, making it more practical for supervised malware classification.","https://schema.org",{"og:url":51,"og:type":87,"og:title":13,"og:site_name":58,"og:description":14},"article",{"robots":89,"canonical":51},"index,follow",{"doc_id":7,"site_id":24},{"code":4,"msg":5,"data":92},[93,97,101,105,110,115,120,123,128,131,135],{"id":20,"doc_module":4,"doc_module_name":45,"category_name":94,"show_sort_weight":95,"slug":96},"Story & Novel",90,"story-novel",{"id":46,"doc_module":4,"doc_module_name":45,"category_name":98,"show_sort_weight":99,"slug":100},"Literature",80,"literature",{"id":52,"doc_module":4,"doc_module_name":45,"category_name":102,"show_sort_weight":103,"slug":104},"Exam",70,"exam",{"id":106,"doc_module":4,"doc_module_name":45,"category_name":107,"show_sort_weight":108,"slug":109},5,"Comic",60,"comic",{"id":111,"doc_module":4,"doc_module_name":45,"category_name":112,"show_sort_weight":113,"slug":114},6,"Technology",50,"technology",{"id":116,"doc_module":4,"doc_module_name":45,"category_name":117,"show_sort_weight":118,"slug":119},7,"Healthcare",40,"healthcare",{"id":11,"doc_module":4,"doc_module_name":45,"category_name":12,"show_sort_weight":121,"slug":122},30,"research-report",{"id":124,"doc_module":4,"doc_module_name":45,"category_name":125,"show_sort_weight":126,"slug":127},9,"Religion & Spirituality",20,"religion-spirituality",{"id":126,"doc_module":4,"doc_module_name":45,"category_name":129,"show_sort_weight":126,"slug":130},"World Cup","world-cup",{"id":132,"doc_module":4,"doc_module_name":45,"category_name":133,"show_sort_weight":132,"slug":134},10,"Lifestyle","lifestyle",{"id":136,"doc_module":4,"doc_module_name":45,"category_name":137,"show_sort_weight":106,"slug":138},19,"General","general"]