# SSCL-TransMD: Semi-Supervised Continual Learning Transformer for Malicious Software Detection
## 4 Experiment
### Experimental Preparations
#### 4.1.3 Evaluation Metrics  
Micro-F1 and Macro-F1  
In binary classification tasks, samples can be classified into true positive (TP), false positive (FP), false negative (FN), and true negative (TN) based on the true class and the class predicted by the classifier.  
\begin{table}
\begin{tabular}{c c c c c c} \hline
**Behavior** & **Mean** & **Std** & **Max** & **Kurtosis** & **Skewness** \\ \hline iccl & 9104.17 & 26,359.2 & 108,371 & 6.44,525 & 2.89218 \\ clock\_gettime & 7588.85 & 26,020.9 & 393,084 & 84.5683 & 8.12852 \\ futex & 7378.71 & 23,027.5 & 300,924 & 49.7566 & 5.48555 \\ getuid32 & 3316.08 & 8492.74 & 55,844 & 6.06572 & 2.73485 \\ sched\_yield & 2907.33 & 96,082 & \(3.69741\times 10^{6}\) & 1224.25 & 34.4471 \\ \hline \end{tabular}
\end{table}
Table 6: Statistics of SMS.  
\begin{table}
\begin{tabular}{c c c c c c} \hline
**Behavior** & **Mean** & **Std** & **Max** & **Kurtosis** & **Skewness** \\ \hline clock\_gettime & 9891.13 & 26,178 & 404,323 & 67.1716 & 6.82103 \\ read & 4486.02 & 15,008.6 & 254,813 & 163.74 & 11.4057 \\ gettimeofday & 3332.5 & 18,156.1 & 189,054 & 52.4767 & 7.24224 \\ futex & 2471.43 & 10,954.4 & 365,447 & 924.772 & 28.7321 \\ nanosleep & 2316.64 & 16,726.3 & 176,580 & 56.6665 & 7.57559 \\ \hline \end{tabular}
\end{table}
Table 7: Statistics of riskware.
In binary classification tasks, the formulas for calculating _Precision_, _Accuracy_, _Recall_, and _F1-score_ are as shown in Equations (15)-(18):  
\[Precision=\frac{TP}{TP+FP} \tag{15}\]  
\[Accuracy=\frac{TP+TN}{TP+TN+FP+FN} \tag{16}\]  
\[Recall=\frac{TP}{TP+FN} \tag{17}\]  
\[F1-score=\frac{2*Precision*Recall}{Precision+Recall} \tag{18}\]  
The multi-classification task can be regarded as composed of multiple binary classification tasks. The calculation of Precision and Recall requires weighing the \(Precision_{i}\) and \(Recall_{i}\) for each class, with two approaches: Macro and Micro.  
In the Macro approach, \(Precision_{m}a\) and \(Recall_{m}a\) respectively represent the average Precision and Recall for each class. Afterwards, the F1-score is calculated as the Macro-F1, as shown in Equations (19)-(22). The Macro approach does not consider the quantity of each class and is highly influenced by high accuracy and recall classes.  
\[Precision_{ma}=\frac{\sum_{i=1}^{n}precision_{i}}{n} \tag{19}\]  
\[Accuracy_{ma}=\frac{\sum_{i=1}^{n}accuracy_{i}}{n} \tag{20}\]  
\[Recall_{ma}=\frac{\sum_{i=1}^{n}recall_{i}}{n} \tag{21}\]  
\[F1_{ma}=\frac{2*Precision_{ma}*Recall_{ma}}{Precision_{ma}+Recall_{ma}} \tag{22}\]  
In the process of using Micro, we first calculate the overall _Precision_ and _Recall_ for all categories. Then, we calculate _F1-score_ as Micro-F1, as shown in Equations (23)-(26). The Micro calculation method takes into consideration the quantity of each category and is applicable in cases of imbalanced data distribution.  
\[Precision_{mi}=\frac{\sum_{i=1}^{n}TP_{i}}{\sum_{i=1}^{n}TP_{i}+\sum_{i=1}^{n} FP_{i}} \tag{23}\]  
\[Accuracy_{mi}=\frac{\sum_{i=1}^{n}TP_{i}+\sum_{i=1}^{n}TN_{i}}{\sum_{i=1}^{n} TP_{i}+\sum_{i=1}^{n}FP_{i}+\sum_{i=1}^{n}FN_{i}+\sum_{i=1}^{n}TN_{i}} \tag{24}\]  
\[Recall_{mi}=\frac{\sum_{i=1}^{n}TP_{i}}{\sum_{i=1}^{n}TP_{i}+\sum_{i=1}^{n}FN_ {i}} \tag{25}\]  
\[F1_{mi}=\frac{2*Precision_{mi}*Recall_{mi}}{Precision_{mi}+Recall_{mi}} \tag{26}\]