# Deep Learning Optimisation of Static Malware Detection with Grid Search and Covering Arrays
## 6 Results and Discussion  
### cAgen Tool Hyperparameter Versus Grid Search Results  
Below are the results from cAgen tool for both the Kaggle Table 5 and Ember datasets Table 6.  
Tables 5 and 6 illustrate the results of our study, and below are the key findings:  
1. Both the grid search and cAgen tool were effective in finding optimal hyperparameters for the deep learning models.
2. The cAgen tool was particularly useful for finding optimal hyperparameters for the Ember dataset, which had a larger number of features and samples.
3. The optimised deep learning models achieved significantly higher accuracy than the baseline models for both datasets.
4. The optimised deep learning models achieved higher accuracy than the previous benchmark model for the Ember dataset (it was at 92%).
5. The choice of hyperparameters significantly impacted the accuracy of the models, particularly for the learning rate and number of neurons.
6. The results highlight the potential of using hyperparameter-optimisation techniques for improving the performance of deep learning models in static malware detection  
\begin{table}
\begin{tabular}{c c} \hline
**Hyperparameter** & **Grid Search Space** \\ \hline Number of neurons (per layer) & [55; 60; 65; 70; 75; 80] \\ \hline Batch size & [48; 64; 80; 100; 128] \\ \hline Number of epochs & [20; 40; 60; 80; 100] \\ \hline Optimiser & Adam or SGD \\ \hline Drop-out relay & [0.0, 0.1, 0.2, 0.3, 0.4, 0.5, 0.6, 0.7, 0.8, 0.9] \\ \hline Learning rate & [0.001, 0.01, 0.1, 0.11, 0.12, 0.113, 0.114, 0.2] \\ \hline Activation functions (per layer) & softmax, softplus, softsign, relu, tanh, sigmoid, hard\_sigmoid, linear \\ \hline \end{tabular}
\end{table}
Table 4: DL model grid search configuration space (Kaggle dataset).  
\begin{table}
\begin{tabular}{c c c c c c} \hline
**MI Algorithm** & **Optimal Values Found** & \(t\)**-Strength Values/Grid Search** & **Time to Complete** & **Number of Combinations Searched** & **Score (Accuracy)** \\ \hline \multicolumn{5}{c}{75, 150, 1} \\ \multicolumn{5}{c}{SGD} \\ \multicolumn{5}{c}{tanh, sigmoid} \\ \multicolumn{5}{c}{0.0} \\ \multicolumn{5}{c}{20} \\ \multicolumn{5}{c}{128} \\ \multicolumn{5}{c}{0.0112} \\ \multicolumn{5}{c}{75, 150, 1} \\ \multicolumn{5}{c}{Adam} \\ \multicolumn{5}{c}{tanh, sigmoid} \\ \multicolumn{5}{c}{0.0} \\ \multicolumn{5}{c}{20} \\ \multicolumn{5}{c}{80} \\ \multicolumn{5}{c}{0.0001} \\ \multicolumn{5}{c}{75, 80, 1} \\ \multicolumn{5}{c}{COD} \\ \multicolumn{5}{c}{tanh, relu} \\ \multicolumn{5}{c}{0.1} \\ \multicolumn{5}{c}{20} \\ \multicolumn{5}{c}{80} \\ \multicolumn{5}{c}{0.0112} \\ \multicolumn{5}{c}{75, 80, 80} \\ \multicolumn{5}{c}{Adam} \\ \multicolumn{5}{c}{80} \\ \multicolumn{5}{c}{softsign, tanh} \\ \multicolumn{5}{c}{0.2} \\ \multicolumn{5}{c}{60} \\ \multicolumn{5}{c}{80} \\ \multicolumn{5}{c}{0.0112} \\ \end{tabular}
\end{table}
Table 5: DL Model cAgen results comparison (Kaggle dataset).  
It is important to carefully choose and tune all relevant hyperparameters when training deep learning models for malware detection.  
Table 7 shows the results of the optimised models for the Ember and Kaggle datasets. The table lists the dataset name, the neural network architecture, and the accuracy achieved by the model. The optimised model for Ember is a 6-layer neural network, which achieved an accuracy of 95.7%. On the other hand, the optimised model for Kaggle is a 5-layer neural network, which achieved an accuracy of 98.6%. It is important to note that in the new optimised model, two dropout layers were added for regularisation to avoid overfitting. Dropout layers randomly ignore some of the neurons in the neural network during training, which helps to prevent the model from relying too heavily on any single feature. This ensures the model generalises well and does not overfit the training data. Below, Figure 5 displays the final structure for both models side by side.