# Systematic Review: Malware Detection and Classification in Cybersecurity
## 2 Methodology
### Advanced Malware Detection Techniques
#### 3.6.10. Deep Learning and SVM-Based Malware Detection Technique
The advantages of EMBAM include: (1) a high detection rate and accuracy, derived from the combination of multiple classifiers that compensate for individual limitations; (2) a significant reduction in false positives thanks to cross-validation optimization and hyperparameter tuning; and (3) scalability, since the system allows the incorporation of new binary classifiers without requiring global retraining. The model was evaluated using the UNSW-NB15 and CICIDS2017 datasets, demonstrating substantial improvements over existing approaches in key metrics such as accuracy, detection rate, precision, specificity, false alarm rate, and F1 score. This article provides a comprehensive review of machine learning techniques for malware detection across PCs, mobile devices, IoT systems, and cloud environments. It analyzes feature extraction methods, the algorithms applied, and their effectiveness, highlighting key challenges such as resource constraints, scalability, and the lack of generalizable models. Finally, it proposes future research directions aimed at developing cross-domain detection systems and integrating heterogeneous data sources [51]. 6.12 Deep Dive into Early Ransomware Detection Technique Based on Machine Learning and Event Analysis  
The article titled A Survey of Crypto Ransomware Attack Detection Methodologies: An Evolving Outlook by [PERSON] and [PERSON]. This work addresses ransomware detection is a cybersecurity priority due to the rise of sophisticated attacks that employ evasion techniques. This type of malware encrypts the victim's files and demands a ransom for their recovery. [PERSON] and [PERSON]'s work presents a comprehensive review of crypto-ransomware detection methodologies, highlighting the importance of early detection and the use of machine learning techniques. Ransomware is classified into two types: encrypting ransomware, which renders files unusable through encryption, and locking ransomware, which restricts access to the system. Preventive strategies seek to prevent the attack from being executed, while detection techniques aim to identify the threat before it causes significant damage. Data-driven techniques employ metrics such as file entropy and the use of decoy files to detect anomalous behavior. On the other hand, process-based approaches observe suspicious activities such as key generation or the use of cryptographic APIs, although they have limitations due to the variability of ransomware families and network traffic concealment methods. Machine learning has been widely adopted for crypto-ransomware detection, using individual classifiers (SVM, logistic regression, decision trees, deep neural networks) and ensemble models that combine multiple algorithms to improve accuracy and reduce false positives. Early detection is critical to mitigate damage before the encryption process begins. To achieve this, feature extraction and selection techniques are employed that transform runtime data into representations of malicious behavior, optimizing model performance. The study by [PERSON] and [PERSON] provides a detailed analysis of current techniques for crypto-ransomware detection, emphasizing the role of machine learning as an effective tool to anticipate and mitigate attacks with greater accuracy and a lower false positive rate [69].