# Detection of Exceptional Malware Variants Using Deep Boosted Feature Spaces and Machine Learning
## 5 Results and Discussion  
The malware classification experiments are performed using: (i) Softmax probability-based implementation of customized CNN models, (ii) the proposed DFS-MC, and (iii) the proposed DBFS-MC frameworks. These malware classification models are implemented using training from scratch and TL-based fine-tuning on the Mallmg dataset. The evaluation of malware classification in terms of accuracy, recall, precision, and F1-Score are reported in Tables 6 and 7.  
It is evident from Table 6 that the TL-based approach outperformed the training from-scratch implementation. The TL-based approach received weights from the pre-trained architectures already trained on a variety of data and then fine-tuned according to our  
\begin{table}
\begin{tabular}{c c c c c c c c} \hline \hline \multirow{3}{*}{**Model**} & \multicolumn{6}{c}{**Training Scheme**} \\ \cline{2-9}  & \multicolumn{3}{c}{**Training from Scratch**} & \multicolumn{3}{c}{**Transfer Learning Based**} \\ \cline{2-9}  & **Acc \%** & **Recall** & **Precision** & **F1-Score** & **Acc \%** & **Recall** & **Precision** & **F1-Score** \\ \hline DenseNet-201 & 96.57 & 0.9054 & 0.9080 & 0.9067 & 98.13 & 0.9411 & 0.9373 & 0.9392 \\ Resnet-18 & 96.41 & 0.9203 & 0.9176 & 0.9189 & 98.13 & 0.9416 & 0.9374 & 0.9395 \\ GoogleNet & 87.20 & 0.8505 & 0.8772 & 0.8637 & 97.11 & 0.9178 & 0.9199 & 0.9189 \\ Inception-V3 & 95.72 & 0.8941 & 0.9025 & 0.8983 & 96.36 & 0.8905 & 0.8905 & 0.8905 \\ Xception & 94.48 & 0.9148 & 0.9153 & 0.9150 & 96.01 & 0.8809 & 0.9025 & 0.8916 \\ ResNet-50 & 94.86 & 0.8580 & 0.8934 & 0.8753 & 96.71 & 0.8984 & 0.8840 & 0.8911 \\ AlexNet & 88.38 & 0.8169 & 0.8643 & 0.8399 & 97.91 & 0.9329 & 0.9299 & 0.9314 \\ VGG-16 & 93.41 & 0.8525 & 0.8891 & 0.8705 & 97.13 & 0.9192 & 0.9268 & 0.9230 \\ VGG-19 & 94.97 & 0.8629 & 0.8939 & 0.8782 & 97.46 & 0.9259 & 0.9224 & 0.9241 \\ \hline \hline \end{tabular}
\end{table}
Table 6: Softmax probabilistic-based implementation of customized CNN for malware classification.  
\begin{table}
\begin{tabular}{c c c} \hline \hline
**Metric** & **Symbol** & **Description** \\ \hline Accuracy & Acc & \% of total number of correct detections \\ \hline Recall & R & Proportion of correctly identified classes and actual negative classes \\ \hline Precision & P & Ratio of correctly detected classes close to the actual class \\ \hline F1 Score & F1-Score & Harmonic mean of P and R. \\ \hline \hline \end{tabular}
\end{table}
Table 5: Performance metrics details.  
challenge. Furthermore, the deep features extracted from customized CNNs are fed to ML outperformed softmax-based implementation. This malware classification approach seeks training error minimization. This scheme tailors the model towards the peculiarities of the dataset and may result in weak generalization. The trade-off between training error minimization and improved generalization is leveraged by deep feature extraction and applying conventional ML for classification.  
These experiments concluded that two of the architectures are performing well in our customized framework. Based upon the results from the experiments performed following conclusion can be made based upon accuracy and F1-score.  
* DenseNet-201 and ResNet-18 > all other CNNs
* Deep Feature-Based SVM Classification > SoftMax Probabilistic-based Classification
* TL Based Model > Training from Scratch Models