ARCHIVES

Malware family classification from grayscale byte-plot images is challenging because benchmark datasets are highly imbalanced. On the MalImg dataset, the largest family contains nearly 37 times as many images as the smallest, allowing accuracy alone to conceal poor minority-family performance. This paper presents an EfficientNet-B0 pipeline for classifying 9,339 images into 25 malware families. The approach combines differential augmentation based on family frequency, weighted random sampling, focal loss with inverse- frequency class weights, and ImageNet transfer learning. Experiments use a stratified 60/20/20 train-validation-test split and evaluate accuracy, macro-F1, weighted-F1, ROC-AUC, expected calibration error (ECE), and component ablations. The full model obtains 95.59% test accuracy, 0.9244 macro-F1, 0.9800 macro ROC-AUC, and mean ECE of 0.004.