Search papers, labs, and topics across Lattice.
This study investigates the effectiveness of saliency-guided cutouts in improving the training of Convolutional Neural Networks (CNNs) for malware classification, utilizing High-Resolution Class Activation Mapping (HiResCAM) to optimize cutout placement. Through experiments on the RawMal-TF dataset and CIFAR-100, the authors compare standard random cutouts with low and high saliency cutouts across various cutout sizes and augmentation strategies. The findings reveal that while saliency-guided cutouts do not enhance performance on malware images, they yield slight improvements in natural image classification, highlighting the domain-specific nature of cutout effectiveness.
Saliency-guided cutouts can improve image classification for natural images but fail to enhance malware detection, revealing a critical domain dependency in training strategies.
Dropout regularization is commonly used to reduce overfitting by removing parts of a neural network during training. For Convolutional Neural Networks (CNN), cutouts serve a somewhat analogous purpose. Cutouts can be implemented as data augmentation: the original training image is retained, and additional copies are created with regions removed. In this chapter, we test whether cutout placement can be improved by using High-Resolution Class Activation Mapping (HiResCAM). We compare four controlled training conditions: no cutout, standard random cutout, low-saliency cutout, and high-saliency cutout. We experiment using grayscale malware images from the RawMal-TF dataset (17 families with~1,000 samples per family), and for comparison to natural images, we experiment with the well-known CIFAR-100 dataset. All experiments are based on ResNet18 with~100 training epochs. For the cutout experiments, we test cutout areas of~5\%, 10\%, 20\%, and~30\%, and we consider~$M\in\{4,8}$ augmented copies per original training image. The RawMal-TF results are slightly worse for all three cutout cases (random, high and low saliency) as compared to no cutouts. In contrast, our CIFAR-100 experimental results improve slightly under low-saliency cutout. These results suggest that the value of saliency-guided cutout is domain dependent, and that malware images should not be treated as equivalent to natural images.
