# SFCWGAN-BiTCN with Sequential Features for Malware Detection
## 4 Experiments and Analysis of Results
### Experimental Results and Analysis
#### 4.3.1 Accuracy Analysis Experiments  
In this paper, we use SFCWGAN- and BiTCN-based malware detection methods to verify the accuracy of the model in malware detection. XGBoost is used in combination with several optimization algorithms to analyze the importance of features.  
The algorithm is used to analyze the features after the extraction of the training set samples of the dataset, filtering out the redundant samples, keeping the important ones, and simplifying the sample structure. The extracted 1632 Opcodes and 265 APIs were combined and deweighted to rank the importance, and the top 73 Opcodes and 73 API were reweighted to better analyze the influence of Opcode and API on the importance of the model. The results are shown in Figures 7 and 8.  
Figure 7 shows that the most important Opcode feature is \"MOV\" and the least influential is \"LOOP\"; similarly, Figure 8 shows that the most important API feature is \"time\" and \"GetCommandLine\" is the least influential. At the same time, different features have different importance, and the lower the importance of a feature, the less impact it has on the classification. In this way, invalid features can be filtered to retain the features with high importance and simplify the structure. XGBoost is used in combination with several optimization algorithms to analyze the importance of the features; strongly important features are retained, and redundant features can be filtered out.  
In this paper, ref. [30], three optimization algorithms are used to compare. WOA-XGBoost was used to compare the gray wolf optimizer (GWO)-XGBoost, and Bayesian optimization (BO)-XGBoost was used to determine the importance ranking of features and to analyze the detection accuracy of these models. This is shown in Table 3.  
[PERSON]'s algorithm and [PERSON]'s correlation coefficient were used to analyze the correlation of the features; between features with strong correlation, the remaining features can be removed. The training set samples were extended, and the generated samples were combined with the original samples. The result of this is shown in Figures 9 and 10.  
In order to fully evaluate our model, experimental comparisons based on different methods were conducted on Kaggle and DataCon datasets. On the basis of the dataset expanded with features based on SFCWGAN, the data were randomly divided into 10 parts using the three-fold cross-validation method, respectively; eight of them were selected as the training set and two as the test set.  
Finally, the BiTCN network was trained using test samples input into the training model, and the detection effectiveness of the model was evaluated by combining the test samples. The trends of the average detection accuracy and loss of the model are shown in Figures 11 and 12. The average accuracy and loss functions of the model converge rapidly  
Figure 8: Ranking API in order of importance.  
\begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Family Name** & **Accuracy/\%** & **Precision/\%** & **Recall/\%** & **F1-Score/\%** \\ \hline BO-XGBoost & 97.16 & 97.16 & 97.16 & 97.16 \\ GWO-XGBoost & 97.62 & 97.62 & 97.62 & 97.62 \\ WOA-XGBoost & 98.34 & 98.34 & 98.34 & 98.34 \\ \hline \hline \end{tabular}
\end{table}
Table 3: Quantity Distribution of Sample DataCon Dataset.  
It can be seen that by using the features following the [PERSON]'s correlation coefficient selection, the proposed model is able to accurately classify and detect malware on both datasets, with a significant improvement in accuracy and convergence speed relative to the pre-feature selection. The results show that the use of feature selection can largely mitigate the impact of unbalanced malware family samples, thus improving the final detection accuracy.