## 4 Experimental Results
### Final MRI  
The results generated via this training included the MC pairwise transition training matrix \(T_{MC}\), malware MA pairwise transition training matrix \(T_{MA\ \text{of\ MC}_{n}}\), and final risk index MRI calculated from the first two parameters thereof. First, to create \(T_{MC}\), the 51,300 malware that were used in the analysis were uploaded to VirusTotal [40] and classified into eight basic categories (Ransomware, Worm, Phishing, Banker, Troy/Bot, Ad/Spyware, Packer, and Launcher). A first-order repeated analysis was performed to investigate the relative importance of the malware for each MA, centering on various vaccine engines. Consequently, the following MC pairwise transitional training matrix \(T_{MC}\) was created, as indicated by Equation (14). For comprehensive training, this was repeated \(2^{n}(n<10)\) times. \begin{table}
\begin{tabular}{c c c c c c} \hline \hline  & **MA1** & **MA2** &... & **MA14** & **Weight Value** \\ \hline
**MC1** & \(T_{MA1\ \text{of\ MC}_{1}}\) & \(T_{MA2\ \text{of\ MC}_{1}}\) &... & \(T_{MA1\ \text{of\ MC}_{1}}\) & \(Norm.Aver.\ of\ T_{MC_{1}}\) \\
**MC2** & \(T_{MA1\ \text{of\ MC}_{2}}\) & \(T_{MA2\ \text{of\ MC}_{2}}\) &... & \(T_{MA1\ \text{of\ MC}_{2}}\) & \(Norm.Aver.\ of\ T_{MC_{2}}\) \\
**MC3** & \(T_{MA1\ \text{of\ MC}_{3}}\) & \(T_{MA2\ \text{of\ MC}_{3}}\) &... & \(T_{MA1\ \text{of\ MC}_{3}}\) & \(Norm.Aver.\ of\ T_{MC_{3}}\) \\
**...** &... &... &... &... &... \\
**MC10** & \(T_{MA1\ \text{of\ MC}_{10}}\) & \(T_{MA2\ \text{of\ MC}_{4}}\) & & \(T_{MA1\ \text{of\ MC}_{10}}\) & \(Norm.Aver.\ of\ T_{MC_{10}}\) \\ \hline \hline \end{tabular}
\end{table} 
Table 3: MA training transition matrices and weight values for each malware. \[T_{\text{MC}}=\left[ \begin{array}{cccccccccccc}1&1.87&7.89&3.12&3.92&5.21&6.18&7.11&7.97&8.99 \\ 0.5348&1&6.88&0.48&2.12&2.89&4.11&4.94&5.91&7.89\\ 0.1267&0.1453&1&0.11&0.12&0.18&0.19&0.21&0.31&2.06\\ 0.3205&2.0833&9.0909&1&2.14&3.11&4.19&5.14&6.02&7.08\\ 0.2551&0.4717&8.3333&0.4673&1&2.13&2.93&4.12&5.11&6.1\\ 0.1919&0.346&5.5556&0.3215&0.4695&1&2.11&3.13&4.18&4.87\\ 0.1618&0.2433&5.2632&0.2387&0.3413&0.4739&1&2.16&3.86&4.02\\ 0.1406&0.2024&4.7619&0.1946&0.2427&0.3195&0.463&1&2.07&3.12\\ 0.1255&0.1692&3.2258&0.1661&0.1957&0.2392&0.2591&0.4831&1&2.03\\ 0.1112&0.1267&0.4854&0.1412&0.1639&0.2053&0.2488&0.3205&0.4926&1\end{array} \right] \tag{14}\]  
The sequence data of the 12 features that were collected during the previous process of malware analysis were combined to create a malware pairwise transition training matrix \(T_{MA}\) for machine learning, as indicated by Equation (15). This was repeated \(2^{n}(n<10)\) times for comprehensive training. \[T_{MA}=\left[ \begin{array}{cccccccccccc}1.00&2.89&2.09&4.89&6.92&3.13&1.92& 0.49&0.23&4.98&4.91&0.97\\ 0.35&1.00&1.12&3.17&5.11&2.08&1.12&0.38&0.28&3.71&3.98&1.04\\ 0.48&0.89&1.00&1.89&4.94&2.04&0.89&0.52&0.27&7.04&4.91&0.47\\ 0.20&0.32&0.53&1.00&3.81&1.93&1.03&0.34&0.18&2.98&3.12&0.52\\ 0.14&0.20&0.20&0.26&1.00&0.31&0.18&0.14&0.13&1.12&1.04&0.23\\ 0.32&0.48&0.49&0.52&3.23&1.00&0.48&0.18&0.12&3.04&2.97&0.35\\ 0.52&0.89&1.12&0.97&5.56&2.08&1.00&0.36&0.19&4.89&4.97&0.34\\ 2.04&2.63&1.92&2.94&7.14&5.56&2.78&1.00&0.31&8.98&8.76&4.89\\ 4.35&3.57&3.70&5.56&7.69&8.33&5.26&3.23&1.00&9.02&9.12&5.12\\ 0.20&0.27&0.14&0.34&0.89&0.33&0.20&0.11&0.11&1.00&1.12&0.23\\ 0.20&0.25&0.20&0.32&0.96&0.34&0.20&0.11&0.11&0.89&1.00&0.29\\ 1.03&0.96&2.13&1.92&4.35&2.86&2.94&0.20&0.20&4.35&3.45&1.00\end{array} \right] \tag{15}\]  
\(T_{MA}\) of \(MC_{\text{ca}}\) was created by re-establishing and expressing \(T_{MA}\) with regard to the MAs caused by a certain malware. This is regarded as disproving the fact that the magnitude of the malware's risk index is determined by the MA according to the malware type. Therefore, the size of the \(T_{MA}\) of \(MC_{\text{st}}\) matrix can be readjusted flexibly even when future operators identify various types of malware and MAs other than the 10 malware types and 12 MAs specified herein.