# Deep Learning Optimisation of Static Malware Detection with Grid Search and Covering Arrays
## 3 Methodology  
_Overall Approach_  
This section provides an overview of the methodology used in this study. The overall approach involved utilising deep learning models for static malware detection and optimising their hyperparameters through covering arrays. The study aimed to compare the performance of CAs and grid search in terms of efficiency and accuracy. The first step was to preprocess the dataset and split it into training and testing sets with an 80:20 ratio. The training set was used to train the deep learning models, and k-fold cross-validation with a 3-fold configuration was used to ensure the robustness of the results. Next, the hyperparameters of the deep learning models were optimised through both CAs and grid search. CAs were found to be more efficient in terms of computational resources and time complexity, and they outperformed grid search in terms of model accuracy.  
\begin{table}
\begin{tabular}{c c c c} \hline \hline
**Reference** & **Methodology** & **Limitations** & **Comparison with Proposed Work** \\ \hline
[26] & Machine learning applied to the PE format & Limited dataset size, performance varies with & Early work in the field, smaller dataset used, does not utilise covering arrays for \\  & & dataset size and complexity & hyperparameter optimisation. \\ \hline
[27] & Machine-learning-based classification using & Reliance on feature engineering, performance & Older approach, less efficient feature engineering. \\  & & \(\text{n-gram frequency counts}\) & not evaluated on large-scale dataset & \\ \hline
[29] & Gradient-boosting decision tree algorithm for & Limited evaluation on only one dataset & Methodology not compared with covering arrays \\  & static detection & Limited evaluation on only one dataset & for hyperparameter optimisation. \\ \hline
[30] & Analysis of machine learning models using a & Only used a subset of the Ember dataset, no & Evaluates only a subset of the Ember dataset, no & comparison with covering arrays for \\  & subset of the Ember dataset & Comparative analysis of covering arrays & hyperparameter optimisation. \\ \hline
[31] & Stacked ensemble of fully connected, & Large amount of computational resources & No comparison with covering arrays for \\  & one-dimensional CNNs & required, the selection of hyperparameters & hyperparameter optimisation. \\ \hline
[32] & Novel method for detecting malware using four & Limited evaluation of only one dataset, less & Similar approach to the proposed work, but less \\  & machine learning techniques tuned with cAgen & generation (compatible with classical ML & efficient method for covering array generation \\  & & techniques only) & (classical ML techniques only). \\ \hline
[33] & Utilisation of mixed-level covering arrays to & Limited to audio classification task, no & Different problem domain, no comparison with \\  & design and tune a CNN for audio classification & comparison with grid search & grid search. \\ \hline \hline \end{tabular}
\end{table}
Table 1: Comparison of ML-based static malware-detection techniques.  
In summary, this study demonstrates the potential of utilising deep learning models and CAs to improve static malware detection. The use of CAs for hyperparameter optimisation provides significant advantages over the conventional grid-search approach.