## 4 Evaluation and Results
### Hyperparameters and Experimental Setup  
To train the YOLO11-based malware classification models effectively, we performed a structured hyperparameter tuning process. We adopted a stepwise manual tuning strategy. This allowed us to isolate and evaluate the effect of each core parameter--learning rate, input image size, and optimizer--while keeping the other settings fixed. All tuning experiments were performed using the lightweight YOLO1n variant under a binary classification setting to enable fast iterations and controlled comparisons.  
We first evaluated the impact of learning rate (lr0) by testing four values: 0.1, 0.01, 0.001, and 0.0001. As shown in Table 4, the model trained with 0.001 achieved a strong trade-off between accuracy (99.68%) and training time (48 min). Although 0.0001 slightly improved the F1-score, it incurred a longer training time (1 h 6 min). Based on this, we selected 0.001 as the default for all subsequent experiments.  
Next, we compared three input resolutions: 64 \(\times\) 64, 128 \(\times\) 128, and 256 \(\times\) 256. The 256 \(\times\) 256 configuration achieved the best F1-score (99.79%) and maintained efficient training time (0.81 h), as shown in Table 5. This resolution was adopted as the default setting for all models.  
Finally, we tested three optimizers: Adam, AdamW, and SGD. While SGD produced the highest F1-score (99.83%), it required significantly more training time. Adam was faster but less accurate. AdamW delivered strong overall performance with the fastest training time (0.81 h), making it the most efficient and robust choice for our task. We therefore selected AdamW for all YOLO11 model variants. The results of this evaluation are summarized in Table 6.  
AdamW extends the standard Adam optimizer by decoupling weight decay from the gradient update, which improves generalization and helps prevent overfitting. This decoupling mechanism enhances training stability, particularly in large-scale or imbalanced classification problems [41].  
\begin{table}
\begin{tabular}{c c c c c c} \hline \hline
**Learning** & **Accuracy** & **Precision** & **Recall (\%)** & **F1-Score** & **Training** \\
**Rate** & **(\%)** & **(\%)** & **Recall** & **(\%)** & **Time (h)** \\ \hline
0.1 & 96.41 & 97.88 & 97.30 & 97.58 & 1.10 \\
0.01 & 99.27 & 99.16 & 99.87 & 99.52 & 1.15 \\
**0.001** & **99.68** & **99.87** & **99.70** & **99.79** & **0.81** \\
0.0001 & 99.78 & 99.83 & 99.87 & 99.85 & 1.09 \\ \hline \hline \end{tabular}
\end{table}
Table 4: Performance comparison for different learning rates.  
\begin{table}
\begin{tabular}{c c c c c c} \hline \hline
**Image Size** & **Accuracy** & **Precision** & **Recall (\%)** & **F1-Score** & **Training** \\  & **(\%)** & **(\%)** & **Recall** & **(\%)** & **Time (h)** \\ \hline
64 \(\times\) 64 & 99.59 & 99.70 & 99.75 & 99.73 & 0.77 \\
128 \(\times\) 128 & 99.56 & 99.75 & 99.66 & 99.70 & 0.80 \\
**256 \(\times\) 256** & **99.68** & **99.87** & **99.70** & **99.79** & **0.81** \\ \hline \hline \end{tabular}
\end{table}
Table 5: Performance comparison of different input image sizes To enhance convergence and generalization, we applied a cosine learning rate decay schedule (cos_lr = True), warmup epochs (warmup_epochs = 3), and a small weight decay of 0.0005. We also used mixup data augmentation (mixup = 0.2) and label smoothing was disabled (label_smoothing = 0.0) to retain class purity. The complete set of final training configurations is summarized in Table 7, which outlines the hyperparameter values used across all YOLO11 variants in the main experiments.  
The model is implemented and evaluated on the hardware and software setup detailed in Table 8.