# Automated System-Level Malware Detection Using Machine Learning: A Comprehensive Review
## Bibliometric Analysis
### Appraisal  
The appraisal phase is when selected articles are evaluated based on the contents of the article. The inclusion criteria are used to extract excerpts in the article that are relevant to the research. Excerpts are short clips of text that highlight related aspects of the review. Excerpts were identified from the articles that filtered through the PRISMA process, as seen in Figure 1. Excerpts with a common meaning or interpretation were collated together, with particular reference to the classification algorithms as presented in Section 4 Classification algorithms. This is further demonstrated in Table 1.  
\begin{table}
\begin{tabular}{p{113.8 pt} p{113.8 pt} p{113.8 pt}} \hline \hline
**ML Classifier** & **Author** & **Description** \\ \hline Naïve Bayes & [2] & Proposed Naive Bayes classifier and vessel trajectory clustering in a maritime surveillance system to detect aberrant vessel behavior \\ \hline Naïve Bayes & [3] & A Naive Bayes \& RBF Network anomaly detection model \\ \hline Naïve Bayes & [4] & One-Class Probability Accumulation Detector (OCPAD) \\ \hline Naïve Bayes & [5] & Devised a comprehensive framework for distinguishing between normal and abnormal monitoring signals \\ \hline SVM & [6] & Support Vector Machines and Automatic Feature Selection to hunt for anomalies in Earth Dam and Leveee Passive Seismic Data \\ \hline SVM & [7] & Anomaly detection in EtherCAT-based water level control automation \\ \hline SVM & [8] & SVM and GA for detecting network anomalies \\ \hline SVM & [9] & SVM and Linear Regression Models to investigate Anomaly Detection in Medical Wireless Sensor Networks \\ \hline KNN & [10] & A KNN approach based on self-organizing maps to investigate anomaly detection \\ \hline KNN & [11] & TCM-KNN, a machine learning-based network anomaly detection approach \\ \hline KNN & [12] & structure health monitoring under environmental influences an adaptive Mahalanobis-squared distance and one-class KNN rule-based anomaly detection system \\ \hline ANN & [13] & ANN to investigate the performance of the NSL-KDD dataset \\ \hline ANN & [14] & Flow-Based Anomaly Detection Using a Neural Network Optimized with the GSA Algorithm \\ \hline ANN & [15] & Anomaly Detection in Hybrid Electric Vehicles \\ \hline ANN & [16] & A wireless sensor network-based anomaly detection system for smart cities \\ \hline Decision Tree & [17] & RADE, a resource-efficient supervised anomaly detection system based on decision tree-based ensemble techniques \\ \hline Decision Tree & [18] & A decision tree algorithm to detect DDoS attacks \\ \hline Decision Tree & [19] & A host-based combinatorial technique for the unsupervised categorization of anomalous and usual behavior in computer network ARP data using k-Means clustering and ID3 decision tree learning algorithms. \\ \hline Random Forest & [20] & Intrusion Detection System (IDS) \\ \hline Random Forest & [21] & Fault Detection Using Random Forest Similarity Distance \\ \hline Random Forest & [22] & Random forests used to identify network-based anomalies on active routers \\ \hline Random Forest & [23] & Random Forests and Traffic Entropy to study Network Anomaly Detection \\ \hline Fuzzy Logic & [24] & Used fuzzy logic to detect cross-layer anomalies in smart home sensor networks using mobile agents for cross-layer anomaly identification \\ \hline Fuzzy Logic & [25] & Intrusion Detection System (IDS) that uses multi-agent systems and artificial intelligence techniques such as Fuzzy Logic Controllers (FLCs), Multi-Layer Perceptrons (MLPs), and Adaptive Neuro-Fuzzy Inference Systems (ANFIS). \\ \hline Fuzzy Logic & [26] & An anomaly-based network security cyber sensor \\ \hline \hline \end{tabular}
\end{table}
Table 1: Overview of state-of-the-art works.