## 4 The Proposed Methods
The process involves normalizing the data, creating a covariance matrix, computing the eigenvectors and eigenvalues, and organizing the resulting eigenvectors in a descending order [38]. The pretrained models' features were retrieved from the input data, the best features were selected, and then these selected extracted features were applied in the classification step. Step 4: Classification

For the classification step, the collected features are subsequently stored in a vector representation. To classify the malware families, a different classifier is trained using these features. A review of the literature found that several trials using various classifiers showed improved accuracy results. In the present paper, we employed GDA, KNN, logistic, SVM, RF, and ensemble learning as efficient methods for malware detection. Step 4.1: Gaussian Discriminant Analysis (GDA) Classifier

For many classification applications, Gaussian Discriminant Analysis (GDA) [39] is a viable option because it is an extensively researched and widely understood approach. Since data can be roughly categorized using a normal distribution, the GDA approach is frequently employed for data classification. The classifier is trained using training datasets, which yield a discriminant function that indicates which class a given piece of data is more likely to belong to. If there are fewer training examples versus predicted parameters, GDA can be affected by outliers and overfit the data. Step 4.2: K-Nearest Neighbor (KNN) Classifier

A common and easy-to-use supervised classifier is the KNN [40] model. It involves categorizing a sample according to the k samples from the training set that is closest to it. KNN with a 9-neighbor configuration was employed in this study due to the fact that if we increase K, the overfitting decreases. Although various distance functions may be selected, the Euclidean distance function is typically employed. The sample is then categorized among the k closest samples using a majority vote system or a comparable method. The benefit of KNN is its simplicity, lack of need for an explicit training phase, and high effectiveness in a wide range of applications, particularly with large training sets. The process for building a KNN model is as follows. Previous feature vectors are divided into training and testing data sets. Then, these training sets will be used to train these models. Lastly, the trained KNN model is tested to identify the class of malware that it falls into [41]. Step 4.3: The logistic regression Classifier

The most common supervised machine learning technique, logistic regression [42], represents the majority of applications for binary classification when a logistic function, sometimes referred to as a sigmoid function, is used to generate a probability value ranging from 0 to 1, based on inputs that are independent variables. Three categories exist for logistic regression: binomial, multinomial, and ordinal. Ordinary regression serves as the foundation for this logistic regression [42]. Step 4.4: SVM Classifier

Support Vector Machine (SVM) [43] is an effective machine learning algorithm used for classification and regression tasks. In most cases, however, it is utilized for addressing categorization issues in machine learning. SVMs are useful in many applications. Finding the optimal line or decision boundary to divide n-dimensional space into classes is the aim of the SVM algorithm. We refer to this optimal decision boundary as a hyperplane. To build an SVM model for malware detection, the feature vectors are partitioned into two groups called training and testing. On the training set, these models will be trained. The SVM model that has been trained to identify the class of malware that it corresponds to is tested. Step 4.5: RF Classifier

[PERSON] introduced the Random Forest in 2001 [44], and it plays a significant role in classification tasks.