# PDF Malware Detection Based on Fuzzy Unordered Rule Induction Algorithm (FURIA)
## 4 Results, Analysis, and Discussion  
This section presents and discusses the study's findings. A new model, namely FURIA, is presented for PDF malware detection. FURIA and other benchmarked models are evaluated using a variety of criteria, which are ACC, FM, MCC, MAE, recall, and precision. Figure 3 illustrates the true positive rate (TPR) and false positive rate (FPR) analyses of each model compared with the proposed model. These analyses show the better performance of the FURIA, with the lowest FPR and better TPR. In both situations, it can be found that NB shows the worst outcomes. Figure 4 illustrates the outcome assessed via MAE. The MAE analysis shows the better performance of the proposed model with the lowest error rate, which is 0.0022, and the worst performance of NB with an error rate of 0.0147. All these values are achieved using a confusion matrix. Confusion matrix values achieved via each model are presented in Table 2.  
Figure 2: FURIA algorithm flowchart [22]. Figure 4: Proposed model comparison based on MAE. Figure 3: TPR and FPR analysis of each model. Figure 5 presents the outcomes assessed via precision, recall, and FM. These outcomes also depict the better performance of FURIA, with a value of 0.998 for precision, recall, and FM, respectively. The HT and QDA have the same outcomes of 0.993 for recall, precision, and FM, respectively, while the NB shows the poorest performance with a value of 0.985 individually for recall, precision, and FM. Figure 6 illustrates the evaluation of each model using R\({}^{2}\), accuracy, and a logarithmic trendline. The logarithmic trendline, which is extremely useful when the rate of change in the data is rapidly increasing or falling and then leveling out, is the best-fit curved line. The positive and negative values can both appear on a logarithmic trendline [28]. It may be obtained as follows:  
\[y=a*\ln(x)+b \tag{7}\] \begin{table}
\begin{tabular}{c c c c} \hline \hline
**Models** & & **No** & **Yes** \\ \hline \multirow{2}{*}{FURIA} & no & 8995 & 11 \\ \cline{2-4}  & yes & 27 & 10,953 \\ \hline \multirow{2}{*}{NB} & no & 8807 & 199 \\ \cline{2-4}  & yes & 97 & 10,883 \\ \hline \multirow{2}{*}{J48} & no & 8977 & 29 \\ \cline{2-4}  & yes & 33 & 10,947 \\ \hline \multirow{2}{*}{HT} & no & 8943 & 63 \\ \cline{2-4}  & yes & 67 & 10,913 \\ \hline \multirow{2}{*}{QDA} & no & 8942 & 64 \\ \cline{2-4}  & yes & 82 & 10,898 \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Confusion matrix values achieved via each employed model. Figure 5: Models comparison based on precision, recall, and F-measure. Here, \"In\" is the natural logarithmic function, and a and b are constants in the equation. The following generic equations, which differ only in the most recent input, can be used to retrieve the constants:  
\[\text{a}=\text{INDEX}(\text{LINEAR}(\text{y},\text{ LN}(\text{x})),1) \tag{8}\]  
\[\text{b}=\text{INDEX}(\text{LINEAR}(\text{y},\text{ LN}(\text{x})),1,\,2) \tag{9}\]  
R\({}^{2}\), also known as the coefficient of determination, is a statistical measure that represents the proportion of variance in the dependent variable (or the outcome) that can be explained by the independent variable(s) (or the predictor(s)) in a regression model [28]. It can be calculated as:  
\[\text{R}-\text{squared}=\frac{\text{Explained Variation}}{\text{Total Variation}} \tag{10}\]  
R\({}^{2}\) is consistently between 0% and 100%. The model does not take into consideration any fluctuation in the answer data around its mean, as shown by the 0%. 100% means that the model fully accounts for all the variability in the response data surrounding its meaning. The properties of PDF encouraged hackers to take advantage of several security flaws and circumvent security measures, making the PDF format one of the most effective attack vectors for harmful malware. Therefore, it is essential for information security to accurately recognize malicious PDF files. To this end, this study proposes a model based on FURIA for PDF malware detection.