## 5 Results and Discussion
### Evaluation Results
#### 5.3.1 Performance Results of the Proposed Based on Tamura  
In the first experiment, three classifiers: KNN, SVM, and ELM, are employed for classification after applying the Tamura features approach to the Malimg datasets for feature extraction. Table 2 displays the collected findings for each malware family and the total average accuracy metric following the application of each classifier.  
Most malware families have accuracy levels of 90 or above across all classifiers. It is important to note that two malware families (Allaple.A and Allaple.L) have accuracy levels below 90, as depicted in Figure 12. Consequently, the outcomes are based on unbalanced features and data.  
\begin{table}
\begin{tabular}{c c c c c} \hline \hline \multirow{2}{*}{**Class ID**} & \multirow{2}{*}{**Family Name**} & \multicolumn{3}{c}{**Classification Accuracy (\%)**} \\ \cline{3-5}  & & **KNN** & **SVM** & **ELM** \\ \hline \#1 & Adialer.C & 100 & 98 & 100 \\ \hline \#2 & Agent.FYI & 99 & 98 & 99 \\ \hline \#3 & Allaple.A & 86 & 70 & 85 \\ \hline \#4 & Allaple.L & 88 & 82 & 87 \\ \hline \#5 & Alueron.gen!J & 99 & 98 & 99 \\ \hline \#6 & Autorun.K & 100 & 99 & 100 \\ \hline \#7 & C2 LOP.P & 98 & 98 & 98 \\ \hline \#8 & C2 LOP.gen!g & 98 & 97 & 99 \\ \hline \#9 & Dialplatform.B & 100 & 97 & 100 \\ \hline \#10 & Dontovo.A & 100 & 99 & 100 \\ \hline \#11 & Fakerean & 99 & 97 & 100 \\ \hline \#12 & Instantaccess & 99 & 95 & 99 \\ \hline \#13 & Lolyda.AA1 & 99 & 97 & 99 \\ \hline \#14 & Lolyda.AA2 & 99 & 97 & 99 \\ \hline \#15 & Lolyda.AA3 & 100 & 100 & 100 \\ \hline \#16 & Lolyda.AT & 99 & 97 & 99 \\ \hline \#17 & Malex.gen!J & 99 & 98 & 99 \\ \hline \#18 & Obfuscator.AD & 99 & 99 & 100 \\ \hline \#19 & Rbottgen & 99 & 99 & 99 \\ \hline \#20 & Skintrim.N & 100 & 99 & 100 \\ \hline \#21 & Swizzor.gen!E & 98 & 98 & 98 \\ \hline \#22 & Swizzor.gen!I & 98 & 98 & 98 \\ \hline \#23 & VB.AT & 99 & 96 & 99 \\ \hline \#24 & Wintrim.BX & 99 & 98 & 99 \\ \hline \#25 & Yuner.A & 100 & 96 & 100 \\ \hline  & Average & 95.34 & 93.23 & 95.42 \\ \hline \hline \end{tabular}
\end{table}
Table 2: The results of classification accuracy of three classifiers on Tamura feature across the Malimg dataset.  
The accuracy for each malware family, as seen in Table 2 and Figure 12, follows a similar pattern, especially for the four malware families (CL2 OP:gen!g, C2 LOP.P, Swizzor.gen!E, and Swizzor.gen!I). According to an examination of the picture data for each of the families, these malware families share comparable visual motifs, as depicted in Figure 13.  
Even though all classifiers employ the same feature vector, their results vary. This is because each classifier has a unique set of traits. The graph in Figure 12 also includes the accuracy results of some classifiers. According to the accuracy results, the ELM on unbalanced datasets achieved a high classification accuracy of 95.42 percent using 10-fold cross-validation. The outcomes showed that the KNN produces substantial values (95.34) close to the ELM optimal. SVM performed poorly when compared to other classifiers, including KNN and ELM. For this purpose, in the first findings section of this paper, we took the proposed model based on Tamura and ELM classifier into consideration.  
Figure 12: The classification accuracy based manual feature method across three classifiers.  
Figure 13: Graphical analysis of the malware families: (**A**) CL2 OP:gen!g, (**B**) C2 LOP.P, (**C**) Swizzor.gen!E, and (**D**) Swizzor.gen!I. showing matching visual patterns.