## 4 The Proposed Method
Forecasting the category of the supplied data sets is the first step in this procedure. The terms target, label, and classes are frequently used to describe the classes. Numerous studies have rated KNN, Random Forests, ELM, Neural Networks, and Support Vector Machines as having good predicted accuracy results in terms of supervised learning and performances. As practical approaches for malware classification, we used KNN, SVM, and ELM in this paper. Step 4.1: **K-Nearest Neighbor (KNN) Classifier. **  
Since it is typically a good first option when creating classifiers, the KNN classifier was selected as the first classifier for this research. The easiest and most widely used supervised classifier is the k-Nearest Neighbor (KNN) [30]. It entails categorizing a sample using the k instances from the training set that are closest to it. The Euclidean distance between each feature vector in the training samples and the test sample is determined. Following that, the KNN class labels--where k is an integer--are used to identify the unknown class label. Multiple feature vectors are split into training and testing data sets to create a model, which will be used to create and train the KNN model on the training set. To identify the malware family class for each sample, test the trained KNN model. Step 4.2: **SVM Classifier. **A linear maximum margin classifier called Support Vector Machines (SVM) [31] works by identifying the ideal hyperplane that best distinguishes between two classes. Binary SVM classification can be expanded for multi-class problems by breaking down a multi-class task into numerous binary classification tasks using one-versus-one or one-versus-all approaches. Multiple feature vectors are split into training and testing data sets to create a model, which will be used to create and train the SVM model on the training set. To identify the malware family class for each sample, test the trained SVM model [32]. Step 4.3: **Extreme Learning Machines (ELM) Classifier. **  
An Extreme Learning Machine (ELM) [33] is a simplistic design that connects the input layer connected to the hidden layer and the hidden layer to the output layer. Typically, an ELM contains just one hidden layer. Random assignments are made to the weights and bias matrix between the input and the hidden layer [34]. The aforementioned procedures are computed once. In contrast, weights are regularly adjusted by back-propagation algorithms, which go back and forth. ELMs are incredibly quick for training owing to this one-time computation [34]. Figure 8 shows the ELM design, where the input layer is represented by X, the hidden layer by H, and the output layer by Y. Despite some controversy, experimental investigations have demonstrated that ELMs can deliver respectable predictive performance in some tasks and at a far lower training cost than networks that are trained through back-propagation. The high number of new malware varieties makes ELMs appealing for malware classification. To build a model, multiple feature vectors are divided into two portions (training and testing data sets) that will be utilized to develop and train the ELM model on the training set. Test the trained ELM model to determine the family class of each malware.