# Automated System-Level Malware Detection Using Machine Learning: A Comprehensive Review
## 4 Classification Algorithms
### K Nearest Neighbour (KNN)  
In their study, [PERSON]. [10] investigated anomaly detection using a K-Nearest Neighbour (KNN) approach based on self-organizing maps which are capable of quantizing errors of test data against healthy training data. Their study addressed limitations in existing methods by improving self-organizing maps for anomaly detection. By eliminating noise-dominated best-matching units from healthy training data, they obtained healthy references. They used the K-Nearest Neighbor algorithm is used to find neighbors of a given test data observation that existed in the references for a given test data observation. The Euclidean distance between the test data observation and the centroid of the neighbors was determined and compared to the least quantization error. This method proved to be less sensitive to noise compared to quantization-error-based metrics and did not impose restrictions on the convexity or distribution of the best matching units. Their approach was confirmed using data from cooling fan bearing experiments. Ref. [43] introduced TCM-KNN, a machine-learning-based network anomaly detection approach utilizing Transductive Confidence Machines (TCM) and K-Nearest Neighbors (KNN). Their approach demonstrates superior performance on the widely used KDD Cup 1999 dataset, outperforming existing anomaly detection algorithms in terms of true positive rate, false positive rate, and confidence. The proposed method exhibits robustness and effectiveness even in the presence of noisy data. Additionally, it effectively addresses the issue of high-dimensional data by incorporating feature selection techniques while maintaining excellent detection performance. According to [44] Weighted KNN classifiers have practical applications in real-time detection of large-scale attacks, such as DoS attacks. The selection of essential features is crucial for developing an effective anomaly-based NIDS. To ensure optimal performance, NIDS systems must not only exhibit outstanding detection capabilities but also operate in real-time. It is vital to have a robust feature selection that identifies the most relevant and minimal characteristics for an efficient NIDS classifier. In their study, the researchers employed a combination of a genetic algorithm and KNN to select and assign weights to the features. During the training phase, all 35 initial attributes were evaluated, and the top five were chosen for testing the NIDS systems. Subsequently, the systems were tested for various DoS attacks. The results revealed an impressive overall accuracy of 97.42% when only the top 19 attributes were considered for known attacks. By utilizing the top 28 attributes, the NIDS achieved an overall accuracy rate of 78% for attacks carried out by unknown perpetrators. In their research, [PERSON]. [12] proposed an innovative method called AMSD-KNN for anomaly detection in structural health monitoring (SHM) under environmental influences. The commonly used Mahalanobis-squared distance (MSD) anomaly detection method in SHM faces significant challenges and limitations, including environmental variability, threshold determination, inaccurate covariance matrix estimation, and non-Gaussian training data, resulting in false alarms and inaccurate damage detection. The researchers aimed to address these issues by developing AMSD-KNN, which combines adaptive Mahalanobis-squared distance with a one-class KNN algorithm. The core idea behind AMSD-KNN is to reduce ambient variability and estimate local covariance matrices using a two-stage technique that identifies appropriate nearest neighbors from the training and testing datasets. To ensure well-conditioned local covariance matrix estimation, an efficient technique based on a multivariate normality hypothesis test is used to find a sufficient number of nearest neighbors. The proposed AMSD-KNN approach combines a single-class KNN rule with a single multivariate distance measure, providing an unsupervised learning strategy for SHM.