## 4 Experimental Results and Comparisons
### Results Analysis
Moreover, Table 7 provides a comparison among the eight fine-tuned CNN models in terms of the evaluation metrics: Acc., Prec., Rec., Spec., NPV, FPR, FNR, FDR, FOR, F1-Score, and Mis. Class. Rate. In general, all employed CNN models achieved excellent classification results. Therefore, detecting malware images using imbalanced datasets can use these models effectively. Additionally, the results disclose again that the FT VGG16 model outperformed the other seven CNN models in almost all tested metrics. Furthermore, Table 8 introduces a quantitative comparison of the computational overhead among the used CNN models in the proposed visualized malware multi-classification framework in terms of the (a) number of layers of the employed CNN model including the consecutive series or the parallel layers used for extracting features from the input malware images, (b) storage requirement which is defined as the allocated size of the employed model on the storage disk, (c) total number of the parameters in the original CNN model calculated based on the number of filters, weights, and stride values, (d) number of non-trainable parameters of the frozen layers in the used CNN-based TL model, (e) number of trainable parameters of the unfrozen layers in the employed CNN-based TL model, (f) total execution time of the training and validation processes of the employed CNN model (g), average time per malware sample which is calculated by dividing the total execution time by the total number of input malware samples, and finally (h) the percentage of reduced non-trainable parameters to the overall number of parameters of a specific CNN model. The obtained results in Table 8 show how the computational time of the training and validation processes various from one CNN model to another. The complexity variation is based on the used number of layers and the number of trainable parameters. In addition, the average time spent to classify the malware type and its family is adequate for all employed CNN models. This is due to the use of the transfer learning and the significant reduction in the training parameters that reaches 99.9% in some of the models. Most of the training parameters and layers were frozen, as discussed in Section 3.3. For example, the best accurate VGG16 CNN-based TL model used in the proposed framework achieved a low execution time of 0.7065 s to identify the malware sample. Only 102,400 parameters were trained from 138 million parameters that existed in the original CNN model. \begin{table}
\begin{tabular}{c c c c c c c c c} \hline \hline
**Evaluation** & **VGG16** & **AlexNet** & **DarkNet-53** & \begin{tabular}{c} **DenseNet-** \\ **201** \\ \end{tabular} & \begin{tabular}{c} **Inception-** \\ **V3** \\ \end{tabular} & \
\begin{tabular}{c} **Places365-** \\ **GoogleNet** \\ \end{tabular} &
\begin{tabular}{c} **ResNet-50** \\ **V2** \\ \end{tabular} \\ \hline Acc. & 0.9997 & 0.9996 & 0.9996 & 0.9996 & 0.9995 & 0.9995 & 0.9994 & 0.9994 \\ \hline Prec. (PPV) & 0.9904 & 0.9857 & 0.9897 & 0.9868 & 0.9866 & 0.9834 & 0.9799 & 0.9775 \\ \hline Rec. (TPR) & 0.9901 & 0.9858 & 0.986 & 0.9867 & 0.9838 & 0.9836 & 0.9789 & 0.9771 \\ \hline Spec. (TNR) & 0.9998 & 0.9998 & 0.9998 & 0.9998 & 0.9998 & 0.9997 & 0.9997 & 0.9997 \\ \hline NPV & 0.9998 & 0.9998 & 0.9998 & 0.9998 & 0.9998 & 0.9997 & 0.9997 & 0.9997 \\ \hline FPR & 0.0002 & 0.0002 & 0.0002 & 0.0002 & 0.0002 & 0.0003 & 0.0003 & 0.0003 \\ \hline FNR & 0.001 & 0.0142 & 0.014 & 0.0119 & 0.0162 & 0.0164 & 0.0211 & 0.0229 \\ \hline FDR & 0.0096 & 0.0143 & 0.0103 & 0.0132 & 0.0134 & 0.0166 & 0.0201 & 0.0225 \\ \hline FOR & 0.0002 & 0.0002 & 0.0002 & 0.0002 & 0.0002 & 0.0003 & 0.0003 & 0.0003 \\ \hline F1-Score & 0.9902 & 0.9857 & 0.9877 & 0.9859 & 0.9832 & 0.9832 & 0.9785 & 0.977 \\ \hline Mis Class. Rate & 0.0003 & 0.0004 & 0.0004 & 0.0004 & 0.0005 & 0.0005 & 0.0006 & 0.0006 \\ \hline \hline \end{tabular}
\end{table} 
Table 7: Average values of the evaluation metrics of the eight examined fine-tuned CNN classification models.