## 3 Proposed Model
### Quantitative Hierarchy Analysis of Malware and Its MAs
#### 3.1.2 Creating and Learning Pairwise Comparison Matrix <Stage 2>
The probability between these malicious activities is an important factor that determines the malware's degree of risk. Therefore, \(2^{n}(n<10)\) repeated experiments were conducted on the 51,300 malwares, and machine learning was performed under the Markov chain assumption [37]. This was done to create a more objective and quantified basis of judgment for the risk indices created by the malware analysis tools. The pairwise comparison matrix created in Stage 2 was recreated as a transition matrix through the Markov chain assumption. Here, it is necessary to remove the assumption that the dataset that creates the transition matrix is independent and identically distributed (_i.i.d._) Thus, the sequential process that results in the MAs for each malware is assumed to exhibit an intuitive cause-and-effect relationship. Therefore, even when new and variant malware are considered, the _i.i.d._ assumption must be removed. Hence, the probability product rule is used to express the combination distribution of the sequential observed values in the form of the following Markov model (3), without a loss of generality. \[p(x_{1},\...........,\ x_{n})=p(x_{1})\prod\
olimits_{n=2}^{N}p(x_{n}|x_{1},\...........,\ x_{n-1}) \tag{3}\]  
As shown in Equation (1), the Markov model considers the dependence of future observation values on previous observation values. As such, the number of observation values and the model complexity increase, which is disadvantageous. However, in this study, repeated experiments indicated that the complexity did not increase significantly even though new and variant activities were considered in the sequential process between the MAs of the observed malware. Therefore, the Markov model was used to create a transition matrix that was then recreated as a pairwise comparison matrix. Rather than a first-order Markov chain process, an \(n\)-order Markov chain process was considered. The transition matrix was recreated as a second-order Markov chain process, as follows:  
\[p(x_{1},\........,\ x_{N})=p(x_{1})p(x_{2}|x_{1})\prod\
olimits_{n=3}^{N}p(x_{n}|x_{ n-1},\........,\ x_{n-2}) \tag{4}\]A first-order Markov process is typically more general than an independent model but is still fairly limited. In the case of many sequential observation values, it is believed that the trends in several rounds of continuous observation values provide important information for predicting the next value. One method for eliciting effects from the previous observation values is to use a higher-order Markov process. If predictions are made depending on observation values from two previous stages, as shown in Figure 2, they are analyzed as second-order Markov processes [37]. Therefore, in this model, the conditional distribution of a certain observation value \(x_{n}\) is dependent on the two previous observation values \(x_{n-1}\) and \(x_{n-2}\). In this study, 10 rounds of repeated experiments were performed on the malware and its MAs. The results indicated that for orders of \(\geq\)2, the second-order joint probability values converged similarly without change to an average value of 93.7%. Therefore, for an optimum performance, an algorithm based on the second-order Markov assumption was implemented in this study. Hence, a matrix (_MC_) of pairwise comparisons between 10 malware types was created, as shown in Table 1, as well as a matrix (_MA_) of pairwise comparisons of 12 types of malware MAs, as shown in Table 2.  
Training was performed with the secondary Markov chain that was executed for repeated rounds using Equation (4). The optimal pairwise transition training matrices \(T_{MC}\) and \(T_{MA\ of\ MC_{n}}\) were created as follows:  
\[T_{MC}=\left[ \begin{array}{cccccc}1&mc_{1,2}&mc_{1,3}&mc_{1,4}&\ldots&mc_{1,10}\\ mc_{2,1}&1&mc_{2,3}&mc_{2,4}&\ldots&mc_{2,10}\\ mc_{3,1}&mc_{3,2}&1&mc_{3,4}&\ldots&mc_{3,10}\\ mc_{4,1}&mc_{4,2}&mc_{4,3}&1&\ldots&mc_{4,10}\\ \ldots&\ldots&\ldots&\ldots&\ldots&\ldots\\ mc_{10,1}&mc_{10,2}&mc_{10,3}&mc_{10,4}&\ldots&1\\ \end{array} \right] \tag{5}\]  
\[T_{MA\ of\ MC_{n}}=\left[