## 4 Experimental Results and Discussion
### Feature Selection  
The malware feature set is typically high-dimensional and sparse, which is not conducive to malware classification. However, most classifiers perform better on low-dimensional dense features. Therefore, this paper mainly uses the chi-square verification algorithm to shrink the size of single-category features and selects the optimal number of features by evaluating the performance of the XGBoost algorithm under cross-validation. For the Byte_2-gram feature: In all combinations of 2-grams, the chi-square validation at intervals of 50 and the XGBoost classification algorithm are selected to confirm the single-category features that make it easiest to identify the malware family. The outcomes of the trial indicate that the 350 features selected by chi-square verification eliminate extraneous and pointless elements in the feature set and can tend to the optimal solution in terms of classification performance. Therefore, to clarify the quantity of characteristics in the feature range of 300-400, this paper further confirms that the first 360 features can obtain the highest performance of the classifier through chi-square verification at intervals of 10, which is the optimal solution for the single-category feature set of Byte_2-gram. For the Asm_Pixel feature: Each assembly file image was converted to a NumPy array. The dimension of selected features is reduced based on chi-square validation with an interval of 100, and the XGBoost algorithm is employed to measure the effectiveness of single-category features. The experimental results show that the 2300 features after dimensionality reduction perform better on the classifier. To further determine the number of features, we selected the feature range of 2200-2400 and verified performance based on chi-square validation at intervals of 20. Finally, the first 2300 features were selected to form the optimal feature set of Asm_Pixel. For the Opcodes_2-gram feature: Like the selection method of the first two categories of features, we conducted chi-square validation in the feature range of all Opcodes 2-gram at intervals of 25 and validated the classification effect using the XGBoost classifier. The experimental findings demonstrate that the classifier's classification effect for 625-dimensional features tends to be the optimal solution. Therefore, to further obtain the number of features with the highest classification accuracy, this paper adopted a feature range of 550 to 625 and continues testing at intervals of 5. Experiments confirm that the first 565 features are the optimal solutions for Opcodes_2-gram single-category features. For the feature Opcodes_3-gram: Although the vector space induced by the program for Opcodes_2-gram only has 565 different features. A modest value of n will, however, fail to detect complicated malicious blocks of operations, as the majority of typical operations that might be utilized for malicious purposes require more than one or two machine operation codes. Consequently, we also extracted and utilized the Opcodes 3-gram sequences as \begin{table}
\begin{tabular}{c c c c} \hline \hline
**Class ID** & **Family Name** & **Train Samples** & **Type** \\ \hline
1 & Ramnit & 1541 & Worm \\
2 & Lollipop & 2478 & Adware \\
3 & Kelihos\_ver3 & 2942 & Backdoor \\
4 & Vundo & 475 & Trojan \\
5 & Simda & 42 & Backdoor \\
6 & Tracur & 751 & TrojanDownloader \\
7 & Kelihos\_ver1 & 398 & Backdoor \\
8 & Obfuscator.ACY & 1228 & Any kind of obfuscated malware \\
9 & Gatak & 1013 & Backdoor \\ \hline \hline \end{tabular}
\end{table} 
Table 3: Malware families in the training dataset. features. Due to larger values of \(n\) in the \(n\)-gram leading to a sparser feature matrix, we performed chi-square validation with intervals of 100 on over 60,000 Opcodes 3-gram. The experimental results show that the 2000 features after dimensionality reduction through chi-square verification remove irrelevant and redundant features in the feature set and achieve high classification accuracy on the XGBoost classifier.