# Machine Learning and Deep Learning Based Model for the Detection of Rootkits Using Memory Analysis
## 4 Methodology
### Model Evaluation
These results are graphically shown in Figure 3.

With regard to execution time, it is clear from Table 3, that k-NN provides the minimum time of 0.03 s. DT is also quite faster with an execution time of only 0.04 s. The LSTM model, on the other hand, shows the maximum execution time of 124.02 s.

Confusion matrix is also an important way to visualize the results. It is used in machine learning and classification tasks to describe the performance of a classification

Figure 3: Comparison of Accuracy, Precision, Recall, and F1-score of Models for Rootkit Detection. \begin{table}
\begin{tabular}{c c c c c c} \hline \hline  & **Algorithms** & **Accuracy** & **Recall** & **Precision** & **F1-Score** &
\begin{tabular}{c} **Execution** \\ **Time** \\ \end{tabular} \\ \hline \multirow{4}{*}{Machine Learning} & Random Forest & 95.5\% & 93\% & 98\% & 95\% & 0.25 s \\  & K-Nearest & 92.8\% & 91.5\% & 93.8\% & 92.7\% & **0.03 s** \\  & Neighbor & 95\% & 93\% & 97\% & 95\% & 0.04 s \\  & Decision Tree & **96.2\%** & **94\%** & **99\%** & **96\%** & 0.1 s \\ \hline \multirow{2}{*}{Deep Learning} & Long- and & & & & & \\  & Short-Term & 85.8\% & 83\% & 87\% & 85\% & 124.02 s \\ \cline{1-1}  & Memory & & & & & \\ \hline \hline \end{tabular}
\end{table} 
Table 3: Performance Comparison of Models for Rootkit Detection. model on a set of data for which the true values are known. Figure 4 shows the confusion matrices of the models. ### Discussion

The trained models were evaluated using metrics, such as accuracy, precision, recall, and F1-score. The SVM model showed the highest accuracy of 96.2%, followed by RF with an accuracy of 95.5%. SVM also had a shorter execution time compared to RF. K-Nearest Neighbor (k-NN) exhibited the lowest execution time among all the models. The DL model, LSTM, achieved an accuracy of 85.8%. However, LSTM had a significantly longer execution time compared to the ML classification algorithms because of the computationally intensive operations involved in DL. One of the reasons why LSTM showed the worst results is because small datasets can pose challenges when used to trained complex models such as LSTM. Limited data often leads to over-fitting, causing the model to memorize noise rather than learn meaningful patterns. Moreover, the variance in performance on such datasets makes generalization difficult. Table 4 shows a comparison of our model with the existing literature in terms of approches and dataset properties, whereas Table 5 shows a comparison of our model with the existing literature in terms of the accuracy of different models and execution time. Our research stands out in terms of giving importance to memory analysis for rootkit detection, utilizing Volatility 3.2 and considering a DL algorithm in addition to ML algorithms. The inclusion of execution time is also a unique aspect of our research. By addressing these gaps, our research aims to contribute to the field of rootkit detection and enhance the effectiveness of malware detection approaches. Figure 4: Confusion Matrices of Models for Rootkit Detection. There are a few more important points to note from Table 3. Firstly, in [25], the SVM model achieves 99.9% accuracy. This is higher than the accuracy of our SVM model (96.2%). It is important to note that our study uses a memory approach, whereas [25] uses a dynamic approach. Therefore, a straightforward comparison cannot be made. It is also strange that [25] has very average results with DT (83.71%) and NB (75.35%). Secondly, the only other study to use memory forensics is [18]. Our best results (96.2% for SVM) are very close to theirs (highest accuracy of 96.5% with DT). Their dataset, although larger than ours, is very unbalanced and the accuracy is very sensitive to unbalanced categories. It is also important to point out that our DL model has a higher accuracy than the accuracy of the DL model in [26]. The FNN model in [26] has an accuracy of 67.7%, whereas our LSTM model has an accuracy of 85.8%.