## 5 Comparative Analysis with Existing Approaches  
This section provides a comparative analysis using related existing studies to highlight the distinguishing contribution of this research. The comparison is based on the utilisation of API calls, feature selections, scoring methods, and implemented ML techniques. An overview of these studies follows.  
**Feature Selection and Scoring:** Table 8 evidences that the studies by [PERSON] et al. [14], [PERSON] et al. [20], [PERSON] et al. [41], [PERSON] et al. [52], and [PERSON] et al. [27] primarily focused on feature selection methods, such as feature vectors and N-grams, and they did not emphasise feature scoring. Most of these studies also incorporated malware labelling, while [PERSON] et al. [20] additionally integrated API categorisation. However, our research distinctly incorporated both Chi2 and Gini Importance for effective reduction in feature space and stands out for its inclusion of feature scoring. This approach, combined with the integration of API categorisation and malware labelling, marks it as more comprehensive in its methodology compared to the others in malware detection and classification.  
**Enhanced F1-Score:** As illustrated in Table 9, although [PERSON] et al. [20] and [PERSON] et al. [41] achieved impressive accuracy scores of 98%, our research went a step further by improving the F1-score by 2%. This improvement is significant as it indicates a better balance between recall and precision in the implemented models. The enhanced F1-score demonstrates our model's ability to accurately classify malware without compromising either the recall or precision, which is crucial for the reliability of malware detection systems.  
**Comprehensive Model Evaluation:** Table 9 highlights the fact that our study also considered both the area under the curve (AUC) and specificity metrics for each ML model used. These metrics are vital for a thorough evaluation of a model's performance, providing a more rounded assessment of its effectiveness in malware classification. The inclusion of AUC and specificity offers a deeper understanding of the model's true-positive versus false-positive rates, which is an aspect not covered in the other compared studies. The combination of detailed feature scoring, improved F1-scores, and the inclusion of comprehensive evaluation metrics like AUC and specificity positions our research as a more balanced and holistic approach to malware classification. By addressing the limitations found in previous studies and introducing these comprehensive methods, this paper enhances the reliability and depth of malware analysis.  
\begin{table}
\begin{tabular}{c c c c} \hline \hline
**Research Work** & **Feature Selection** & **Feature Scoring** & **API Categorisation** & **Malware Labelling** \\ \hline [PERSON] et al.[14] & Feature vector & ✗ & ✗ & ✓ \\ [PERSON] et al. [20] & N-gram & ✗ & ✓ & ✓ \\ [PERSON] et al. [41] & N-gram & ✗ & ✗ & ✗ \\ [PERSON] et al. [52] & Feature vector & ✗ & ✗ & ✗ \\ [PERSON] et al. [27] & Feature vector & ✗ & ✗ & ✓ \\
**OUR Research** & Chi2, Gini Importance & ✓ & ✓ & ✓ \\ \hline \hline \end{tabular}
\end{table}
Table 8: Research comparison in terms of feature selection, feature scoring, API categorisation, and malware labelling.