# Malware Variants Detection Model Based on MFF-HDBA
## 5 Experimental Results and Discussion
### Ablation Experiments  
Ablation experiments were implemented in this section to evaluate whether the multi-scale feature extraction blocks could improve the classification effect. In this section, all the  
\begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Model** & **Accuracy (\%)** & **Precision (\%)** & **Recall (\%)** & **F1-Score (\%)** \\ \hline AlexNet8 & 94.12 & 92.77 & 94.11 & 93.19 \\ VGG16 & 97.11 & 97.00 & 97.11 & 97.03 \\ ResNet50 & 97.54 & 97.57 & 97.54 & 97.53 \\ Inception V3 & 98.71 & 98.72 & 98.71 & 98.71 \\ Our model & 99.36 & 99.39 & 99.36 & 99.36 \\ \hline \hline \end{tabular}
\end{table}
Table 6: Performance of each model.  
\begin{table}
\begin{tabular}{c c c c c c} \hline \hline
**Model** & **AlexNet** & **VGG16** & **ResNet50** & **Inception V3** & **Our Model** \\ \hline Parameters & 362.0 & 134.4 & 23.6 & 21.9 & 1.11 \\ (M) & 28.28 & 20.84 & 19.61 & 29.18 & 9.63 \\ \hline \hline \end{tabular}
\end{table}
Table 7: Parameters and MTTDs of the tested models.  
models were trained on the Malimg data set after data augmentation, and the experimental results are shown in Table 8 and Figure 9.  
As shown in Table 8, in comparing CNN with CNN + Channel Attention, and Multi-scale Feature Fusion with Multi-scale Feature Fusion + Channel Attention, the results showed that the classification performance of a model can be significantly improved by introducing channel attention mechanism. Channel attention mechanism can improve the image texture feature extraction capability by enhancing the channel feature expressions with good feature extraction effect, and suppressing the channel feature expressions with poor feature extraction effect in the feature maps. In comparing CNN with Multi-scale Feature Fusion, and CNN + Channel Attention with Multi-scale Feature Fusion + Channel Attention, it was demonstrated that the multi-scale feature fusion effectively improved the accuracy. Global and local information are considered by multi-scale feature fusion, which increases feature diversity. The details of classification in each malware family of  
Figure 8: Accuracy, precision, recall, and F1-scores for each model in every malware family.  
\begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Model** & **Accuracy (\%)** & **Precision (\%)** & **Recall (\%)** & **F1-Score (\%)** \\ \hline CNN & 96.47 & 96.53 & 96.47 & 96.46 \\ CNN + Channel Attention & 97.86 & 97.85 & 97.86 & 97.77 \\ Multi-scale Feature Fusion & 98.72 & 98.86 & 98.72 & 98.73 \\ Multi-scale Feature Fusion + Channel Attention & 99.36 & 99.39 & 99.36 & 99.36 \\ \hline \hline \end{tabular}
\end{table}
Table 8: Results of ablation experiments.  
all the models are shown in Figure 9, which also shows the confusion matrixes for each model. In the confusion matrix, the ordinate represents the predicted label while the abscissa represents the true label of malware families, and the diagonal indicates the correct prediction result. This means that the fewer discrete points there are, the better the detection performance it achieves. Compared with other models, Multi-scale Feature Fusion + Channel Attention achieved the best detection performance due to improvements in classification accuracy for the confusable malware families, particularly in C2 LOP.P, C2 LOP.gen!g, Swizzor.gen!E, and Swizzor.gen!. These results demonstrate that the proposed model enhances critical feature representation, and improves the classification accuracy of confusable malware families.