# Malware Detection Using Memory Analysis Data in Big Data Environment
## 4 Material and Methods
### Machine Learning and Deep Learning Algorithms  
As the complexity and size of datasets increase, detection of malware becomes more difficult. In the literature, machine learning algorithms are widely used to analyze such complex data, extract patterns, and develop technologies in parallel with the development of malware [9]. Machine learning and deep learning algorithms create classification models using extracted features. They then use these models to classify new entries. Generally, the accuracy of the classification predictions represents the success of the algorithm. In this study, two-class classification models, malicious and benign, were established by using the nine different algorithms mentioned below. **Random Forest (RF):** Random Forest is a supervised ensemble algorithm introduced by [PERSON] [45]. It is based on the bagging technique. As seen in Figure 1, it is formed by the combination of multiple decision trees, which are created by choosing random samples. The majority vote is calculated by averaging the results of all decision trees. The final decision is made by a majority vote [46]. Increasing the number of trees (depth) improves accuracy. It is an algorithm that is resistant to the overfitting problem. \begin{table}
\begin{tabular}{c c} \hline \hline
**Label** & **Class Name** \\ \hline
0 & Benign \\
1 & Malware \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Class name and numeric labels. **Decision Tree (DT):** It is a supervised learning algorithm used for classification and regression. As seen in Figure 2, it is a rooted tree model that tests an attribute at each node. Each branch and leaf carry a class label. Attribute values are classified by moving from the root node to the leaf nodes. At each step, a model that predicts classes is created with the decision rule created based on the attributes [45; 47]. Decision trees are an algorithm that are easy to understand and interpret. It is a frequently used machine learning algorithm in the literature. Some of the most well-known decision tree examples are ID3, J48, CART, and C4.5. In this study, CART was used as tree type in both Decision Tree algorithm and Random Forest algorithm. **Naive Bayes (NB):** It is a supervised machine learning algorithm based on [PERSON] theorem. It calculates the probability of a sample belonging to a class. Naive Bayes accepts that the emergence of a feature is independent of other features. Likewise, it is assumed that each feature independently contributes equally to the computation [45]. The probability value is given as 0 when there is new data in the test dataset that is not in the training set. Mathematically, the probability equation of [PERSON] theorem is:  
\[\mathbf{P}(\mathbf{A}|\mathbf{B})=\frac{\mathbf{P}(\mathbf{B}|\mathbf{A}) \mathbf{P}(\mathbf{A})}{\mathbf{P}(\mathbf{B})} \tag{2}\]  
\(\mathbf{P}(\mathbf{A}|\mathbf{B})\)--Posterior probability of the class when the predictor is given;  
\(\mathbf{P}(\mathbf{A})\)--Prior probability of the class;  
\(\mathbf{P}(\mathbf{B}|\mathbf{A})\)--Probability of the predictor when class is given;  
\(\mathbf{P}(\mathbf{B})\)--Prior probability of the predictor. **Logistic Regression (LR):** It is a supervised machine learning algorithm used for regression and classification. It estimates the dependent target variable using the set of  
Figure 1: Random Forest Structure. Figure 2: Decision Tree Structure. independent variables. It takes probability values between 0 and 1. It uses the sigmoid function shown in Figure 3 to position linear outputs between 0 and 1. **Gradient Boosted Tree (GBT):** It is a supervised ensemble algorithm used for regression and classification. It is based on the boosting technique. It is an algorithm based on a weak learner tree. In the decision tree, a model is created for the weak learner and a prediction is made. Calculation errors are passed on to the next weak learning tree, as shown in Figure 4. The last model is the strong learner and is the weighted average of all models.