## 5 Experimental Results
### Results  
In binary classification, where the goal is to predict whether a sample belongs to one of two classes, the classifier's predictions can be summarized using several evaluation metrics. True Positive Rate (TPR), also known as sensitivity or recall, is the number of samples correctly classified as positive divided by the total number of positive samples. False Positive Rate (FPR), also known as the fall-out, is the number of samples incorrectly classified as positive divided by the total number of negative samples. Accuracy is the number of correct predictions divided by the total number of samples. In the malware detection scenario, TPR corresponds to the probability that a benign sample is correctly classified as benign. In contrast, FPR corresponds to the probability that a malware sample is incorrectly classified as benign. In this case, a high TPR and low FPR are desirable, as it means that the classifier can accurately detect benign.exe files while avoiding false alarms. In the malware categorization scenario, where the goal is to predict the family type of a malware sample, TPR corresponds to the probability that a sample is correctly classified as belonging to its true family type. FPR corresponds to the probability that a sample is incorrectly classified as belonging to a different family type. In this case, a high TPR andlow FPR are desirable, as the classifier can accurately categorize malware samples into their correct family types. Overall, TPR, FPR, and accuracy are useful metrics for evaluating the performance of a classifier in both malware detection and malware categorization scenarios. These metrics can help us understand how well the classifier can identify malware samples and classify them into their correct family types. We summarize our results in terms of TPR, FPR, and Accuracy. We do not report FRR and TRR because they can be computed easily by \(\text{FNR}=1-\text{TPR}\) and \(\text{TRR}=1-\text{FPR}\), to avoid redundancy. It is clear from the results reported in Figure 6a,b that the classifiers achieved high performance in the malware detection task. In particular, the MLP classifier performed well on the full set of features, achieving a TPR of 99.7% and an FPR of 0.81%. The RF classifier also performed well on the full set of features, achieving a slightly lower TPR of 99.12% but a lower FPR of 0.2%. On the selected feature subset, the RF classifier was the top performer, achieving a TPR of 99.28%, an FPR of 0.43%, and an accuracy of 99.56%. This suggests that the RF classifier  
Figure 6: Results of different classifiers for malware detection problem. (**a**) Full Features; (**b**) Selected Features. can effectively identify malware samples using a smaller number of features, which can be useful in situations where the number of features is limited. These results indicate that the classifiers could effectively identify malware samples with high accuracy and low false positive rates. The RF classifier showed strong performance on the selected feature subset, which can be useful in situations where the number of available features is limited. The results reported in Table 1 show the training and testing times for the different classifiers. As expected, the training time decreases when the number of features is reduced since the classifiers have to process fewer features to learn the hidden patterns in the data. For example, the training time for the RF classifier is 117.09 s on the full set of features but only 4.2691 s on the selected feature subset. It is also worth noting that the testing time, which is the time taken by the classifier to make predictions on a new sample, also decreases when the number of features is reduced. This can be beneficial in real-world scenarios, where making predictions quickly and efficiently is important. Overall, the results in Table 1 show that reducing the number of features can lead to faster training and testing times for the classifiers without sacrificing performance.