# Automated System-Level Malware Detection Using Machine Learning: A Comprehensive Review
## 4 Classification Algorithms
### Decision Tree  
In their recent work, Ref. [17] developed a resource-efficient supervised anomaly detection system called RADE. The ability to detect anomalies in resource-constrained environments, such as edge devices or heavily loaded servers, has become increasingly crucial due to limitations in on-premises computing, as well as concerns related to security, privacy, and profitability. Existing anomaly detection techniques, particularly those based on decision tree-based ensemble classifiers, can impose a significant resource burden as the number of datasets increases. To address this issue, the researchers introduced RADE, a novel resource-efficient anomaly detection approach that complements existing decision tree-based ensemble classifiers in resource-constrained scenarios. The core concept of RADE is to train a compact model that can accurately identify the majority of requests. For cases where the small model is prone to classification errors, expert models are created using only portions of the training data. RADE is implemented as a classifier using the sci-kit-learn library. The experimental results demonstrate that RADE offers competitive anomaly detection capabilities compared to conventional approaches, while significantly reducing the memory footprint by up to 1212, training time by up to 2020, and classification time by up to 1616. This highlights the effectiveness of RADE in efficiently detecting anomalies while operating within limited resource constraints. In their study, [PERSON]. [18] explored the use of a decision tree algorithm for detecting Distributed Denial of Service (DDoS) attacks. The widespread adoption of the IEEE 802.11 standard [45] for achieving extensive network coverage and high capacity has introduced numerous security challenges. The increased usage of Wi-Fi has made internet connectivity more convenient but has also exposed networks to various hacking attacks. End users and network administrators often encounter anomalies when trying to comprehend and mitigate DDoS attacks, highlighting the need for effective anomaly detection techniques at different levels. To address this issue, the researchers proposed a novel approach for anomaly detection using the Decision Tree algorithm. They aimed to classify instances into respective attack types with a high detection rate, utilizing the KDDCup'99 dataset for classification purposes. This approach aimed to safeguard wireless nodes within the network and protect destination nodes from DDoS attacks. It also aimed to identify attack patterns and facilitate the implementation of appropriate countermeasures. The proposed approach combined two well-known classification techniques, Ref. [3] and Random Forest, with the Decision Tree algorithm to construct an intrusion detection system. Intrusion Detection Systems (IDS) are crucial for effectively handling computer intrusions. They operate by generating alerts that prompt analysts to take preventive measures against potential breaches. By leveraging the decision tree-based approach, [PERSON]. [18] demonstrated a powerful method for detecting DDoS attacks. The IDS-based on the decision tree algorithm achieved high accuracy in classifying attack instances and provided valuable insights for mitigating and preventing such attacks. Intrusion detection systems are designed to identify and distinguish unauthorized behavior from that of authorized users. Over the years, various approaches, ranging from traditional statistical methods to advanced data mining technologies, have been employed to develop Intrusion Detection Systems (IDS) for safeguarding computers and networks against hostile attacks. However, commercial IDS systems typically rely on predefined signatures and are limited in their ability to detect unknown attack attempts. In this study, we propose a novel approach for detecting misuse and anomalous attacks using a decision tree technique. By leveraging the decision tree algorithm, we construct a classification model that can effectively identify and classify abusive and abnormal activities.