## 3 Methodology
### Feature Extraction
#### 3.4.1 Texture Feature (SFTA)
The recall, ER, accuracy and AUC values of classifiers are also plotted in the graph shown in Figure 8.

.3.3 Experiment 3: With Imbalanced Data and Using Featured Obtained from a Pre-Trained Network Model

Two pre-trained neural networks (AlexNet and Inception-v3) are used as deep feature extractors, and the classification results are presented in Table 5. \begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Classifier** & **Recall (\%)** & **Accuracy (\%)** & **AUC (\%)** & **ER (\%)** \\ \hline Gaussian SVM & **98.0** & 98.5 & **100.0** & 1.5 \\ Decision Tree & 72.0 & 76.8 & 99.0 & 23.2 \\ Weighted KNN & 95.0 & 96.3 & 99.0 & 3.7 \\ Fine Gaussian & 94.0 & 95.7 & **100.0** & 4.3 \\ Boosted Decision Tree & 98.0 & 98.4 & **100.0** & 1.6 \\ Adaboost & 96.0 & 95.2 & 99.0 & 4.8 \\ Linear Discriminate & 97.6 & **99.3** & 60.0 & **0.7** \\ Cubic SVM & **98.0** & 98.2 & **100.0** & 1.8 \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Classification results using balanced data and SFTA features. Best values are shown in bold. Figure 8: Classification results (recall, accuracy, AUC, and ER) using SFTA features on the balanced (augmented) dataset. The quadratic SVM used an on imbalanced dataset performed well and obtained a maximum classification accuracy of 98.3%, recall of 97.0%, AUC of 88.0%, and ER of 1.7% on 10-fold cross-validation. The quadratic SVM obtained minimum ER and maximum AUC as compared to other classifiers such as weighted KNN, linear discriminate, and some more in Table 5. The recall, ER, accuracy and AUC of certain classifiers are also plotted in the graph shown in Figure 9.

#### 4.3.4 Experiment 4: With Balanced Data and Fusion of SFTA and Pre-Trained Network Features

Experiment 4 aims to confirm the usefulness of a balanced dataset on a DCNN. For a DCNN, all malware balanced dataset images are resized to \(227\times 227\times 3\). This experiment takes less training time as compared to the above experiments. Two pre-trained networks, AlexNet and Inception-V3, are used as deep feature extractors. The feature fusion of the pre-trained network and handcrafted method (SFTA) results are revealed in Table 6, and their visualization is shown in Figure 10. \begin{table}
\begin{tabular}{c c c c c} \hline
**Classifier** & **Recall (\%)** & **Accuracy (\%)** & **AUC (\%)** & **ER (\%)** \\ \hline Linear SVM & 96.0 & 97.5 & 85.0 & 2.5 \\ Fine Decision Tree & 96.0 & 97.4 & 85.0 & 2.6 \\ Weighted KNN & 66.0 & 44.6 & 60.0 & 55.4 \\ Fine KNN & 67.0 & 54.8 & 63.0 & 45.2 \\ Cosine KNN & 97.0 & **98.7** & 88.0 & **1.3** \\ Boosted Decision Tree & 78.0 & 68.9 & 72.0 & 31.1 \\ Quadratic SVM & 96.0 & 97.5 & 85.0 & 2.5 \\ Linear Discriminate & 96.0 & 98.1 & **88.0** & 1.9 \\ Cosine Decision Tree & 72.0 & 58.6 & 63.0 & 41.8 \\ Medium Decision Tree & 69.0 & 51.4 & 60.0 & 48.6 \\ Cubic SVM & **97.0** & 98.3 & **88.0** & 1.7 \\ \hline \end{tabular}
\end{table} 
Table 5: Imbalanced data without feature fusion and optimization results on pre-trained network. Best values are shown in bold. Figure 9: Classification results (recall, accuracy, AUC and ER) using a fusion of SFTA and pre-trained network features on the original (imbalanced) dataset. Table 6 shows a maximum accuracy level of 99.3%, recall of 99.0%, AUC of 100.0%, and ER of 1.3% on cubic SVM, as compared to some more classifiers depicted in Table 6, which shows the effectiveness of balanced data and the robustness of the proposed technique. The pre-trained network works well with balanced datasets and obtained maximum accuracy on certain classifiers. The recall, accuracy, and AUC values of the balanced dataset are higher than for the imbalanced dataset. ### Statistical Analysis

To assess the statistical significance of the results, we adopted the non-parametric Friedman test for the compared methods on all cross-validation folds. As the classification results are not Gaussian distributed, the Friedman test was applied to detect differences in the classification results of various methods across multiple runs.