# Tree-Based Classifier Ensembles for PE Malware Analysis: A Performance Revisit
## 2 Related Work  
[PERSON] et al. [7], [PERSON] et al. [10] provide the machine learning taxonomy for malware analysis, while [11] present an overview of malware analysis in CPS and IoT. Malware analysis can be accomplished via either static or dynamic analysis, or a mix of the two, depending on how the information extraction procedure is carried out. Approaches based on static analysis evaluate the content of samples without necessitating their execution,whereas dynamic analysis examines the behavior of samples by executing them. This study analyzes a static analysis of PE files, since it can yield a plethora of useful information, e.g., the compiler and symbols used. Meanwhile, machine learning techniques were largely employed in malware detection [29; 30]. Malware samples were examined and the extracted features are used to train the classification algorithm. An overview of the machine learning techniques used for the classification of malware is provided in the following. We particularly explore malware detectors that employ at least one ensemble learning technique. [PERSON] et al. [31], [PERSON] et al. [17], [PERSON] et al. [32], [PERSON] et al. [33] utilized random forest for malware detection based on PE file characteristics and networks. Furthermore, [PERSON] et al. [34], [PERSON] et al. [35], [PERSON] et al. [36] developed a random forest classifier to detect malware using various features, such as system calls, file system, and Windows registry. [PERSON] and [PERSON] [13] proposed an ensemble learning strategy to address the shortcomings of the existing commercial signature-based techniques. The proposed technique was able to focus on the most salient features of malware PE files by lowering the dimensionality of the data. [PERSON] et al. [37] and [PERSON] et al. [38] compared the use of various machine learning algorithms to detect PE malware and showed that XGBoost and logistic regression were the best-performing methods. [PERSON] et al. [39] employed data visualization and adversarial training on ML-based detectors to effectively detect the various types of malware and their variants in order to address the current issues in malware detection, such as the consideration of attacks from adversarial examples and the massive growth in malware variants. In [40], a deep feature extraction technique for malware analysis was addressed in light of the current progress in deep learning. Deep features were obtained from a CNN and were fed to an SVM classifier for malware classification. Moreover, a CNN ensemble for malware classification was proposed in [15; 16]. The proposed architecture was constructed in a stacked fashion, with a machine learning algorithm providing the final classification. A meta-classifier was selected after various machine learning algorithms were analyzed and evaluated. Most recently, [PERSON] et al. [41] proposed a CNN-based feature extraction and a channel-attention module to reduce the information loss in the process of feature image generation of malware samples. Specific deep learning architectures, such as a deep belief network and transformer-based classifier, were also considered when classifying Android [42; 43] and PE malware [44], respectively. Table 1 presents a summary of the existing malware detectors described in the literature.