## 4 Experimental Results and Comparisons
### Results Analysis  
In the simulation studies, we tested eight different CNN models (VGG16, AlexNet, DarkNet-53, DenseNet-201, Inception-V3, Places365-GoogleNet, ResNet-50, and MobileNet-V2) on the families of the Malimg dataset presented in Table 5. As discussed before, we divided the dataset as 80% for training and 20% for testing. As shown in Table 5, this dataset is imbalanced. Therefore, to handle this challenge, we applied the fine-tuning process for the CNN layers and hyperparameters without employing any data augmentation, as discussed in Section 3.4. The performance analysis of the simulation tests in terms of the confusion matrix, loss and accuracy curves, and other different evaluation metrics were carried out by MATLAB 2020b. An Intel Core i7-4500 processor with 8 GB RAM was used for training and classification processes. For simplicity in presenting the simulation results, the accuracy and loss curves, the confusion matrix, and the other calculated evaluation metrics are presented in detail for VGG16, the best accomplished fine-tuned model among the eight examined CNN models. For the other fine-tuned CNN models, we give the average values of all tested evaluation metrics to provide deep comparisons among them. The accuracy and loss curves of the training and testing processes of the fine-tuned VGG16 model across 20 epochs are shown in Figure 5. As can be observed from these curves, both loss and accuracy curves were steady before less than ten epochs. Additionally, there is no overfitting of the training samples because there is a complete similarity between the training and testing curves for the proposed fine-tuned VGG16 model. Therefore, by using a smaller number of epochs, the performance of the proposed fine-tuned VGG16 CNN model was superior. Likewise, we observed similar accuracy and loss curves for the other seven fine-tuned CNN models. The confusion matrix obtained for the fine-tuned VGG16 model is shown in Figure 6. This is a multi-classification confusion matrix for the tested 25 malware families of the imbalanced Malimg dataset. The _TN, FN, TP_, and _FP_ values for the individual detected  
Figure 5: Accuracy and loss curves for the fine-tuned VGG16 classification model. malware families could be calculated with the aid of the multi-classification confusion matrix given in Figure 3. It is noticed that the attained _TN_, _FN_, _TP_, and _FP_ values for the fine-tuned VGG16 model were as desired and close to the optimal values. This is due to the fine-tuning process of the CNN layers and hyperparameters. These achieved results confirm the low misclassification rate, where almost all malware families were correctly classified with high accuracy. Minimal families reported misclassification of their tested instances, which did not exceed two cases of malware images. The model succeeded in achieving 100% accuracy by 60% of the malware families where all their tested instances were classified correctly. For the rest of families most of them had only one misclassification such as 'C2 LOP_gen!g' family with one _FN_; and only one family with 2 misclassifications which is 'Lolyda_AA2'. We tested the capability of each fine-tuned CNN model of the eight examined models in classifying individual malware families. We calculated the accuracy (Acc. ), precision (Prec. ), recall (Rec. ), specificity (Spec. ), NPV, FPR, FNR, FDR, FOR, F1-Score, and misclassification rate (Mis. Class. Rate) for each malware family in the Malimg dataset. Then, we computed the average values of these evaluation metrics. Table 6 shows the obtained results of each malware family in addition to the overall average per evaluation metric after applying the fine-tuned VGG16 classifier. The results revealed that the proposed fine-tuned VGG16 model achieves significant values near optimum for all examined assessment metrics. Thus, this model is highly recommended to be applied in the context of efficient detection and classification of visualized malware samples. Figure 6: Confusion matrix of the fine-tuned VGG16 classification model.