# A Study on Detection of Malicious Behavior Based on Host Process Data Using Machine Learning
## 5 Conclusions  
In conclusion, this study focused on detecting malicious behavior based on host process data using machine learning. The study utilized a number of machines learning algorithms, including KNN, NB, RF, AE, and MemAE, to classify data as either malicious or normal. Additionally, the study incorporated dimensionality reduction techniques such as PCA and UMAP and employed the ADASYN and SMOTE sampling method to improve the classification performance of the models. The performance of the models was evaluated using several metrics, including Precision, Recall, F1-Score, and AUROC. The results indicate that the preprocessed dataset (SMOTE) improved the performance of the models and that all models achieved higher Precision, Recall, F1-Score, and AUROC values than the original dataset. The results indicate that both the preprocessed datasets (ADASYN and SMOTE) improved the performance of the models and that all models achieved higher Precision, Recall, F1-Score, and AUROC values than the original dataset. In particular, the best performance was obtained when using the preprocessed dataset (SMOTE) with the MemAE model, yielding an F1-Score of 1.00 and an AUROC value of 0.9826. This study is important because it provides a valuable framework for detecting malicious behavior based on host process data using machine learning. The results of this study can be used to enhance the security of computer systems and protect against various types of attacks, including malware and intrusion attempts. Additionally, the techniques and methods used in this study can be applied to other domains and datasets to improve the performance of machine learning models. Overall, this study demonstrates the potential of machine learning in detecting malicious behavior and offers a valuable contribution to the field of cybersecurity. It is an excellent thesis that provides a comprehensive overview of the problem and a thorough analysis of the techniques used to address it. The methods and findings presented in this study can be used to inform future study and to develop practical tools for detecting and preventing malicious behavior in a wide range of settings. \begin{table}
\begin{tabular}{c c c c} \hline \hline
**Models** & **Precision** & **Recall** & **F1-Score** \\ \hline KNN & 0.90 & 0.93 & 0.91 \\ NB & 0.77 & 0.82 & 0.79 \\ RF & 0.89 & 0.92 & 0.90 \\ AE & 0.93 & 0.96 & 0.94 \\ MemAE & 0.92 & 0.96 & 0.94 \\ \hline \hline \end{tabular}
\end{table} 
Table 7: Malicious behavior detection results by model using the original dataset. \begin{table}
\begin{tabular}{c c c c} \hline \hline
**Models** & **Precision** & **Recall** & **F1-Score** \\ \hline KNN & 0.94 & 0.91 & 0.93 \\ NB & 0.93 & 0.88 & 0.90 \\ RF & 0.83 & 0.78 & 0.80 \\ AE & 0.92 & 0.93 & 0.92 \\ MemAE & 0.97 & 0.94 & 0.96 \\ \hline \hline \end{tabular}
\end{table} 
Table 8: Malicious behavior detection results by model using the preprocessed dataset (ADASYN). \begin{table}
\begin{tabular}{c c c c} \hline \hline
**Models** & **Precision** & **Recall** & **F1-Score** \\ \hline KNN & 0.98 & 0.96 & 0.97 \\ NB & 0.86 & 0.86 & 0.86 \\ RF & 0.98 & 0.96 & 0.97 \\ AE & 1.00 & 0.99 & 0.99 \\ MemAE & 1.00 & 1.00 & 1.00 \\ \hline \hline \end{tabular}
\end{table} 
Table 9: Malicious behavior detection results by model using the preprocessed dataset (SMOTE). For future study, more sophisticated machine learning algorithms and analysis techniques can be applied to improve the detection of malicious behavior in host process data. This involves exploring the use of state-of-the-art technologies such as deep learning algorithms to enhance the performance of the models. Additionally, while our study collected and analyzed data from a single host, it is necessary to analyze data from multiple hosts to achieve a more accurate detection of malicious behavior at the network level.