# Tree-Based Classifier Ensembles for PE Malware Analysis: A Performance Revisit
## 5 Conclusions  
This article examined tree-based ensemble learning algorithms that analyze PE malware. Several tree-based ensemble techniques, including random forest, XGBoost, CatBoost, GBM, and LightGBM, were assessed based on a number of performance criteria, such as accuracy, MCC, precision, recall, AUC, and F1. In addition, we incorporated cutting-edge malware datasets to comprehend the most recent attack trends. This work contributed to the prior research in several ways, including by providing a statistical comparison of fine-tuned tree-based ensemble models utilizing several malware datasets. Furthermore, this article can be expanded in a number of ways, including by looking at the explainability of tree-based ensemble models and signature-based malware classification. Furthermore, a deep neural network model for tabular data, such as TabNet [52], has been underexplored in this application domain, providing a new direction for future research. Finally, it is anticipated that tree-based PE malware detection will be deployed in various real-world settings, such as in host, network, and cloud-based malware detection components.  
\begin{table}
\begin{tabular}{l c c c c c} \hline \hline
**CatBoost** & **XGBoost (Native)** & **LightGBM** & **Random Forest** & **GBM (H2O)** & **GBM (H2O)** \\ \hline
0.250153 & - & 0.125201 & 0.7014781 & 0.6092802 & 0.8983268 \\ \hline \hline \end{tabular}
\end{table}
Table 8: The \(p\)-value of Quade post-hoc, in which XGBoost (native) is used as a control algorithm.  
\begin{table}
\begin{tabular}{l c c c c} \hline \hline
**Study** & **Accuracy (\%)** & **Precision (\%)** & **Recall (\%)** & **F1 (\%)** \\ \hline _Kaggle_ & & & & \\ \hline [PERSON] et al. [42] & 93.68 & 93.96 & 93.36 & 93.68 \\ [PERSON] et al. [43] & 96.66 & 96.55 & 96.76 & 96.66 \\ [PERSON] et al. [38] & 98.60 & 96.30 & 99.00 & - \\ This study (GBM (H2O)) & **99.39** & **99.27** & **99.92** & **99.59** \\ \hline _BODMAS_ & & & & \\ \hline [PERSON] et al. [41] & 99.29 & 98.07 & 98.26 & 94.23 \\ [PERSON] et al. [44] & 96.96 & - & - & 96.96 \\ This study (XGBoost (native)) & **99.96** & **99.65** & **99.81** & **99.73** \\ \hline _CIC-MalMem-2022_ & & & & \\ \hline [PERSON] et al. [37] & 99.97 & 99.98 & 99.97 & 99.97 \\ This study (Random forest) & **100.00** & **100.00** & 99.99 & **100.00** \\ \hline \hline \end{tabular}
\end{table}
Table 9: Performance comparisons over existing studies. The best performance value on each dataset is shown in bold.  
**Author Contributions:** Conceptualization, M.H.L.L. and B.A.T.; methodology, B.A.T.; validation, M.H.L.L.; investigation, M.H.L.L.; writing--original draft preparation, M.H.L.L.; writing--review and editing, M.H.L.L. and B.A.T.; visualization, B.A.T.; supervision, B.A.T. All authors have read and agreed to the published version of the manuscript.  
**Funding:** This research received no external funding.  
**Institutional Review Board Statement:** Not applicable.  
**Informed Consent Statement:** Not applicable.  
**Data Availability Statement:** Not applicable.  
**Conflicts of Interest:** The authors declare no conflict of interest. The funders had no role in the design of the study; in the collection, analyses, or interpretation of data; in the writing of the manuscript, or in the decision to publish the results.  
**List of Acronyms**  
\begin{tabular}{l l} AUC & Area Under ROC Curve. \\ CART & Classification and Regression Tree. \\ CNN & Convolutional Neural Network. \\ CPS & Cyber-Physical Systems. \\ CV & Cross Validation. \\ DBN & Deep Belief Network. \\ DR & Detection Rate. \\ DT & Decision Tree. \\ FPR & False Positive Rate. \\ GBDT & Gradient Boosting Decision Tree. \\ GBM & Gradient Boosting Machine. \\ IoT & Internet of Things. \\ MCC & Matthews Correlation Coefficient. \\ NB & Naive Bayes. \\ PE & Portable Executable. \\ RF & Random Forest. \\ SAEs & Stacked AutoEncoders. \\ SVM & Support Vector Machine. \\ t-SNE & t-Stochastic Neighbor Embedding. \\ TPR & True Positive Rate. \\ \end{tabular}