# Machine Learning and Deep Learning Based Model for the Detection of Rootkits Using Memory Analysis
## 4 Methodology
### Model Evaluation  
The trained model's performance is evaluated in this phase. Testing data, separate from the training data, is used to assess the model's accuracy and generalization ability. It is crucial to ensure that the evaluation data is distinct to avoid over-fitting. If the model does not meet the required criteria, model tuning is performed by adjusting the algorithm's parameters to optimize its performance and enhance the accuracy of the results. The evaluation process is a critical step in assessing the effectiveness of the proposed method. Several evaluation measures are used to measure the performance of the models, including the confusion matrix, accuracy, precision, recall, and F1-score. An explanation of these measures is given below:  
```
1. Import necessary libraries (NumPy, Matplotlib, Pandas, Seaborn, Category Encoders, Scikit-Learn, Time). 2. Import the dataset from a CSV file. 3. Separate the dataset into features (X) and the target variable (y). 4. Split the dataset into training and testing sets. 5. Normalize the dataset using MinMaxScaler to scale values between 0 and 1. 6. Encode categorical features using an ordinal encoder. 7. Create a Decision Tree Classifier with the Entropy criterion and a maximum depth of 3. 8. Train the Decision Tree Classifier with the Entropy criterion. 9. Make predictions on the test data. 10. Calculate and print the accuracy score using the Entropy criterion. 11. Measure and print the execution time for this model. 12. Create a confusion matrix for evaluating model performance. 13. Visualize the confusion matrix using a heatmap. 14. Print a classification report for model evaluation. 15. End of the Code. #### Confusion Matrix

This is a 2 \(\times\) 2 matrix that contains the actual and predicted values as defined below:

* True Positive (_TP_)--represents the correctly predicted positive instances;
* True Negative (_TN_)--represents the correctly predicted negative instances;
* False Positive (_FP_)--represents the incorrectly predicted positive instances;
* False Negative (_FN_)--represents the incorrectly predicted negative instances. #### Accuracy

This is a measure of the overall correctness of the predictions and is calculated as the ratio of the sum of _TP_ and _TN_ to the total number of instances. \[\text{Accuracy}\ =\ \frac{TP+TN}{TP+TN+FP+FN}, \tag{10}\]

#### Precision

This is the percentage of correctly predicted positive instances out of all positive predictions. \[\text{Precision}\ =\ \frac{TP}{TP+FP}, \tag{11}\]

#### F1-score

This is a harmonic mean of precision and recall. It provides a balanced measure of model performance. \[\text{F1\_score}\ =\ \frac{2\times(Precision\times Recall)}{Precision+Recall}, \tag{12}\]

#### Recall

This is also known as sensitivity or true positive rate. It represents the percentage of actual positive instances that are correctly classified. \[\text{Recall}\ =\ \frac{TP}{TP+FN}, \tag{13}\]

Finally, the _Execution Time (ET)_ is another important measure that indicates the time taken by the model to process the dataset. It was calculated using the time() function in Python. ## 5 Results and Discussion

### Results

This section presents the evaluation metrics for the DT, RF, SVM, k-NN, and LSTM models. The models were trained and evaluated using a 75/25 split of the dataset, with 75% used for training and 25% for testing. Feature selection reduced the initial 53 features to 47. Based on the confusion matrix, the accuracy, precision, recall, and F1-score were calculated for each model and summarized in Table 3. It is easy to see that SVM achieved the highest accuracy of 96.2%, followed by RF with an accuracy of 95.5%. LSTM, a DL model, had an accuracy of 85.8%, demonstrating its potential for rootkit detection.