# Deep Learning Model with Sequential Features for Malware Classification
## 4 Experiments and Analysis of Results
### Comparison Experiments for Classification Algorithms  
Regarding model performance, comparative experiments were conducted with reference to existing literature. Comparison experiments were done on the 9-Class-data dataset with reference to the relevant literature [9; 10; 26; 27; 28]. Experimental results are shown in Table 8. Among the five comparative studies, two focused on machine learning, one was related to gene sequence classification, and the remaining two concerned deep learning models. [PERSON] et al. [26] used opcode features and grayscale map features, which were extracted and later detected by svm for classification. [PERSON] et al. [27] processed grayscale graphs converted from malware, downscaling the features by PCA, and then classifying them using the machine learning model known as K nearest neighbor. [PERSON] et al. [28] used a genetic detection method similar to Strand to classify text. [PERSON] et al. [10] extracted byte and opcode sequences, and then used a classifier composed of two CNNs for classification. [PERSON] et al. [11] extracted features via a CNN model for grayscale maps and LSTM model for opcode features, then fused the results for classification. These methods produced good results, but there remained a gap between them and the method of this study. Under the accuracy evaluation criterion, our proposed TCN-BiGRU model integrating opcode and byte features achieved 99.72% accuracy; the accuracy values of the five comparison studies were all below 99.72%. Therefore, our proposed model incorporating both features and fusing TCN and BiGRU performed best.  
For the 2-Class-Datacon dataset, we referred to the literature [29; 30; 31] to perform comparison experiments with the results shown in Table 9. Among these three comparison studies, one was on integration learning, one was on deep learning, and one was on machine learning. [PERSON] et al. [29] extracted grayscale maps of malicious samples, extracts feature with different parameters for GIST descriptors, and then adopted the KNN and random forest algorithms to integrate classification by voting algorithm. [PERSON] et al. [30] also processed malicious sample images; it first pre-trained a good convolutional neural network model and then used the Xgboost algorithm for classification. [PERSON] et al. [31] extracted the assembly instructions of malware samples. The assembly instructions were then pre-processed and downscaled using the LDA algorithm and were finally trained with the random forest algorithm for classification. These methods produced good results, but there remain gaps between them and the method proposed in this paper. Under the ACC evaluation criterion, our TCN-BiGRU model integrating opcode and byte features reached 96.54% accuracy; the ACC values of the three comparison papers were all under 96.54%. After the above comparative experiments on two datasets, it was proved that our proposed model integrating both features and fusing TCN and BiGRU performed best and had strong generalization capability.  
\begin{table}
\begin{tabular}{l l l} \hline \hline
**Model** & **No Pooling** & **Average Pooling** \\ \hline One-class SVM [26] & Opcode + Grayscale map & 92\% \\ PCA and kNN [27] & Grayscale map & 96.6\% \\ Strand Gene Sequence [28] & Asm sequence & 98.59\% \\ Orthrus [10] & Byte + Opcode & 99.24\% \\ MalNet [11] & Opcode + Grayscale map & 99.36\% \\ Model in this paper & Opcode + Byte & 99.72\% \\ \hline \hline \end{tabular}
\end{table}
Table 8: 9-class-data dataset_model comparison.  
\begin{table}
\begin{tabular}{l l l} \hline \hline
**Model** & **No Pooling** & **Average Pooling** \\ \hline KNN + RandomForest [29] & Grayscale map & 93.03\% \\ CNN + Xgboost [30] & Grayscale map & 93.44\% \\ LDA + RandomForest [31] & Opcode & 95.58\% \\ Model in this paper & Opcode + Byte & 96.54\% \\ \hline \hline \end{tabular}
\end{table}
Table 9: 2-Class-Datacon model comparison.