## 4 Experimental Results
### Results  
Table 4 shows the results of the two phases (stream- and file-level classifications) using integer encoding and MalCode2 Vec, respectively. A single file consists of multiple streams, if even one stream is malicious, so the entire file is considered malicious. This rule, where a file is classified as malicious if at least one of its streams is detected as malicious, was applied to evaluate performance at the file level. As previously discussed, the Transformer's capability to focus on different parts of the sequence and identify key patterns in malware scripts significantly influences the model's effectiveness. This was evident in the strong performance of the Transformer with integer encoding, outperforming CNN using MalCode2 Vec. In malware detection, false negatives are critical because they refer to cases where malware is mistakenly identified as benign. This allows the malware to evade detection and carry out attacks on the system, potentially leading to data leaks, backdoor installations, and other security breaches. Additionally, a detection model with a high false-negative rate suffers from reduced reliability, making it difficult to use it in real-world applications. Table 5 shows the false-positive rates. Our model shows the lowest false-positive rate. \begin{table}
\begin{tabular}{l l c} \hline \hline
**Model** & **Parameter Setting** & **Value** \\ \hline \multirow{8}{*}{Transformer} & Embedding dimension & 100 \\  & Attention heads & 3 \\  & Dropout & 0.2 \\  & Dense layer (Transformer) & 32 units \\  & Dense layer (FC) & (32, 16, 10) units \\ \hline \multirow{4}{*}{CNN} & Filters & 256, 256, 128 \\  & Kernel size & 3 \\  & Dense layer (FC) & 64 units \\ \hline \multirow{4}{*}{BERT} & LSTM units & 256 \\  & Learning rate & \(2\times 10^{-5}\) \\ \cline{1-1}  & Optimizer & Adam \\ \hline \hline \end{tabular}
\end{table} 
Table 3: Parameter settings for the proposed method and other reference models. Figure 9 shows the predictions made by the Transformer model, highlighting the words that contributed the most influence on the prediction category. Notably, the EPS family malware includes string manipulation operations (_exch_, _concatstrings_, _roll_, _copy_), file operations (_writestring_, _readhexstring_, _concatstrings_, _closefile_), and a suspicious long hexadecimal string at the end (_bindexec4d5a_...), which is likely an encoded malicious payload. The attention mechanism highlights these operators along with '.exe', underlining their significance in the prediction process. PE family malware often highlights elements such as the batch file, directory path of batch files and registries kernel.dll, and API functions. The directory path of the batch file is mentioned to add a path to the PATH environment variable of the operating system, a tactic commonly associated with exploiting the Windows operating system. Figure 10 shows the highlights on the bat file and its corresponding suspicious file path involving _quer.bat_. The repetitive creation of similarly named files (_Users/105/Desktop_, _AppData/Local/Temp_) in different directories is a common malware behavior for persistence and propagation. VBA script family malware usually includes various scripts. Figure 11 highlights the key suspicious elements, such as the character code operation (_fromCharCode_) and control flow elements like _else_ and _return_. ShellCode family malware includes an NOP (no-operation) sled, which comprises a sequence of NOP instructions (opcode 0 \(\times\) 90, AAAAAAAAAAAAAA), inserted before a shellcode to ensure proper execution by aligning the instruction pointer. Figure 12 shows the highlights on the _AAAAAAAAAAAA_ NOP sled. Our model inherently captures structural and semantic representations of a code, making it more resilient to simple obfuscation techniques that do not alter the program's logic.