# Systematic Review: Malware Detection and Classification in Cybersecurity
## 2 Methodology
### Advanced Malware Detection Techniques
#### 3.6.10. Deep Learning and SVM-Based Malware Detection Technique  
The article titled A Novel Deep Learning-Based Approach for Malware Detection by [PERSON], [PERSON], and [PERSON]. The authors highlight that malware detection is a critical task in cybersecurity, especially given the constant evolution of threats and evasion techniques. Traditional static and dynamic analysis methods have significant limitations: static analysis is fast but ineffective against obfuscated malware variants, while dynamic analysis is more robust but costly in terms of time and resources. In this context, the study by [PERSON] et al. proposes a novel approach based on deep learning that combines the strengths of both types of analysis. The method begins by viewing portable executable (PE) files as color images, transforming their binary sequences into RGB representations. This conversion allows pre-trained deep learning models to be used to extract relevant features without requiring manual attribute engineering or expert domain knowledge. Once the images are obtained, deep features are extracted using 15 fine tuned deep neural network models, originally trained on large image datasets. These features are extracted from the last fully connected layer of each network and used as input to a support vector machine (SVM)-based classifier, which performs binary detection between malware and benign software. The effectiveness of the proposed approach was validated using three benchmark datasets: Malimg, VirusShare, and the Microsoft Malware Dataset. Specifically, an accuracy of 99.06% was achieved on the Malimg dataset, significantly outperforming conventional and other machine learning-based approaches. To mitigate class imbalance, data augmentation techniques were applied, further improving the classifier's overall performance. Performance was evaluated using standard metrics such as accuracy, sensitivity, true negative rate, and false positive rate. The experimental results show an average improvement of 16.56% over previous solutions, with statistical significance according to the Wilcoxon test. In summary, the study by [PERSON] et al. presents a scalable, cost effective, and highly effective solution for malware detection, integrating deep learning and machine learning models. This architecture not only optimizes predictive accuracy but also improves the interpretability of model decisions, a key aspect for security analysts [36]. 6.11. Network Anomaly Detection Technique Using a Distributed Big Data System-Based Enhanced Stacking of Binary Classifiers  
The article An Improved Multiattack Network Anomaly Detection in Distributed Big Data System Based Enhanced Stacking Multiple Binary Classifiers,by [PERSON] et al., addresses the problem of network anomaly detection using a distributed system based on big data, in response to the increasing volume of traffic generated by Internet of Things (IoT) devices and the associated cybersecurity threats [52]. The proposed architecture is structured in three layers: collection and storage, processing, and application. The first manages data acquisition through distributed systems; the second employs processing frameworks to extract value from the data; and the third implements cloud-based interactive solutions to facilitate maintenance and improve performance. The central technique of the study is the Enhanced Stacking of Binary Classifiers (EMBAM), an intrusion detection system (IDS) that combines multiple binary classifiers using stacking techniques. The base classifier is a decision tree (DT), optimized with grid search, accompanied by K-Nearest Neighbor (KNN) and Support Vector Machines (SVM) algorithms, allowing for efficient approach to binary classification problems with both linear and nonlinear generalization capabilities.