# Automated System-Level Malware Detection Using Machine Learning: A Comprehensive Review
## 4 Classification Algorithms
### Hidden Markov Model (HMM)  
In their work, Ref. [34] proposed an approach that utilizes a hidden Markov model (HMM) of privilege flows to detect anomalies. This approach was developed as a response to the limitations of misuse detection methods in intrusion detection, which rely on normal behavior patterns. By employing an HMM, which is a powerful tool for modeling sequential data, the proposed approach aims to reduce false-positive errors and increase detection rates. However, one challenge with HMM-based intrusion detection is the time-consuming process of modeling normal behavior and analyzing intrusions, which hinders real-time detection. To address this issue, Ref. [34] present an efficient HMM-based intrusion detection system that analyzes privilege transition flows using attack domain knowledge. By incorporating this domain knowledge, the proposed system achieves improved performance while reducing the time required for intrusion detection. Experimental results demonstrate that the suggested technique outperforms the conventional method, which processes all data, in terms of both speed and detection quality. The proposed HMM-based approach offers a valuable solution for detecting anomalies in privilege flows, enabling faster and more accurate intrusion detection.  
Ref. [35] employed Hidden Markov Model (HMM) in order to detect network intrusions that deviate from normal behavior. As cyberattacks grow increasingly sophisticated, it is crucial to have proactive measures in place to protect target systems. Existing defense products may struggle to establish correlations among diverse sensor data, which leaves vulnerabilities in the network environment. For instance, a compromised and undetected client with low security awareness could serve as a steppingstone for attackers to infiltrate the target system. Traditional signature-based intrusion detection systems may fail to identify such premeditated attacks. In the context of multi-phase assaults, a state-based categorization technique proves valuable. This study introduces a series of attack states that correspond to different stages of an attack and proposes a detection method based on Hidden Markov Model, which is a state-based classification model. By utilizing HMM, the system can effectively identify and classify sophisticated planned attacks. Experimental results have demonstrated the effectiveness of the proposed detection system in accurately detecting such intrusions.  
Ref. [36] conducted research on Anomaly Detection Techniques using the Hidden Markov Model to identify unauthorized activities occurring on wired and wireless networks. While there are various intrusion detection algorithms available, it is necessary to develop additional reliable methods to effectively detect intrusions and minimize false-positive rates. In their study, [PERSON] et al. focused on exploring Anomaly Detection Techniques, with a particular emphasis on the Hidden Markov Model (HMM). The aim was to investigate and develop new approaches for accurately detecting intrusions and reducing the occurrence of false positives. The research aimed to contribute to the improvement of intrusion detection systems by enhancing the reliability and effectiveness of intrusion detection algorithms.