# Malware Detection Approach Based on Artifacts in Memory Image and Dynamic Analysis
## 4 Results and Discussion
### Machine Learning Modeling
However, malware is loaded to the memory to be executed. Furthermore, it is preliminary for a malware file to be unpacked and decrypted to be executed. Moreover, malware artifacts remain in the memory for a while, even after the process is terminated [3]. Therefore, the proposed approach, which combines features from both the dynamic and memory analyses better, presents malware behaviors and intentions that are reflected in higher accuracy detection and lower false positive rates. The proposed approach outperforms the other two analyses in terms of accuracy and false positive rates. The highest accuracy rate achieved by the proposed approach was equal to 98.5% compared to 97.4% and 94.8% reached by the dynamic analysis and memory analysis respectively. Moreover, the integrated approach impressively decreases false positive rates, which come as low as 1.7% compared to 4.9% for the dynamic analysis and 5.1% for the memory analysis. A comparison between the evaluation rates from the memory, dynamic and integrated analyses is illustrated in Figure 6.  
The classification time was also measured for each algorithm in the three experiments. The classification time for the integrated approach applying SVM was 15.1 milliseconds. The time reduced after eliminating all the duplicates from the original data set. Our experiment was compared with other memory-based related works. The optimal result of the accuracy and false positive rates for the proposed method was compared to the results of the related experiments, which used Windows as the operating system and the memory analysis as the detection method (see Table 4). From the table, it can be seen that the proposed method has a higher detection rate and a lower false positive rate, and from the comparison of the experimental results, the proposed method outperforms other related works. Although the proposed method has a slightly higher detection accuracy than Aghaeikheriabady [27], there is a significant decrease in the false positive rate between the two methods from 16% to only 1.7%. \begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Classifier** & **DR (\%)** & **FPR (\%)** & **Accuracy (\%)** & **Time (ms)** \\ \hline
**Naïve Bayes** & 87.4 & 6.3 & 90.7 & 12.3 \\
**SVM** & 98.4 & 1.7 & 98.5 & 15.1 \\
**Decision Tree** & 96 & 5.1 & 96.1 & 46.1 \\
**Random Forest** & 97.9 & 2 & 97.9 & 30.0 \\
**KNN** & 96.6 & 3.6 & 96.7 & 1.0 \\ \hline \hline \end{tabular}
\end{table} 
Table 3: The results of the classifying integrated features. Figure 5: The evaluation rates applying the support vector machine (SVM) on the integrated features. Memory analysis is an effective way to investigate malware goals and activities in memory. However, malware authors try to escape memory analysis by using anti-memory forensics, such as hiding the infected memory regions or preventing analysts from extracting memory information [12]. Additionally, malware try to hide any evidence that uncover its malicious activities seeking to be untraceable and invisible as possible. Therefore, combining behavior analysis and memory analysis overwhelms the memory analysis limitations and better detects malware activities. Further, the combination helps in adding extra related features and, therefore, increases the detection accuracy and lowers the wrongly classified files in the proposed approach.