## 4 Experiment and Discussion
### Experiment Results and Discussion  
For the above test samples, the method proposed in this paper is compared with the commonly used detection methods, and the results are presented in Tables 2-4. The process accuracy is calculated as the number of correctly reported injection processes divided by the total number of reported processes; the page accuracy rate is calculated as the number of correctly reported injected pages divided by the total number of reported pages. The target of malthfind is the thread, so this work uses the page where the calling code module is located as the hidden page of its report. \begin{table}
\begin{tabular}{c c c} \hline
**No** & **Sample** & **Memory Image** \\ \hline \multirow{3}{*}{1} & \multirow{3}{*}{Process Hollowing} & [[https://github.com/m0n0](https://github.com/m0n0) ph1/Process-Hollowing/tree/master/executables/ProcessHollowing.exe]([https://github.com/m0n0](https://github.com/m0n0) ph1/Process-Hollowing/tree/master/executables/ProcessHollowing.exe) (accessed on 15 November 2021). \\  & & & Win/SP0x86, 1 GB \\ \hline \multirow{3}{*}{2} & \multirow{3}{*}{Reflective DLL (Win7)} & [[https://github.com/stephenfewer/ReflectiveDLLInjection/tree/master/bin/inject.exe](https://github.com/stephenfewer/ReflectiveDLLInjection/tree/master/bin/inject.exe)]([https://github.com/stephenfewer/ReflectiveDLLInjection/tree/master/bin/inject.exe](https://github.com/stephenfewer/ReflectiveDLLInjection/tree/master/bin/inject.exe)) (accessed on 15 November 2021). \\  & & & Win/SP0x86, 1 GB \\ \hline \multirow{3}{*}{3} & \multirow{3}{*}{Reflective DLL (Win10)} & \multirow{3}{*}{Sample 2, Win10x64\_19042, 2 GB} \\  & & & \\ \hline \multirow{3}{*}{4} & \multirow{3}{*}{VAD Remapping} & According to the method implementation of [PERSON] et al. [3], the default VAD permissions and injection files are modified. Win/SP1x86, 1 GB \\ \hline \multirow{3}{*}{5} & \multirow{3}{*}{Spyeye (Win7)} & [[https://s.threatbook.com/report/file/6097](https://s.threatbook.com/report/file/6097) ad7b99b374]([https://s.threatbook.com/report/file/6097](https://s.threatbook.com/report/file/6097) ad7b99b374) \\  & & 4994a646d6a3577 cea2 faa89e9e656 fccbbd73244e227c850. (accessed on 15 May 2022) \\  & & & Win/SP1x86, 1 GB \\ \hline \multirow{3}{*}{6} & \multirow{3}{*}{Spyeye (Win10)} & Sample 4, Win10x64\_19042, 2 GB \\ \hline \multirow{3}{*}{7} & \multirow{3}{*}{Cridex} & [[https://github.com/volatilityfoundation/volatility/wiki/Memory-Samples](https://github.com/volatilityfoundation/volatility/wiki/Memory-Samples)]([https://github.com/volatilityfoundation/volatility/wiki/Memory-Samples](https://github.com/volatilityfoundation/volatility/wiki/Memory-Samples)). (accessed on 15 March 2021) \\  & & & WinXPSP3x86, 512 M \\ \hline \multirow{3}{*}{8} & \multirow{3}{*}{Zeus} & [[https://github.com/volatilityfoundation/volatility/wiki/Memory-Samples](https://github.com/volatilityfoundation/volatility/wiki/Memory-Samples)]([https://github.com/volatilityfoundation/volatility/wiki/Memory-Samples](https://github.com/volatilityfoundation/volatility/wiki/Memory-Samples)). (accessed on 15 March 2021) \\  & & & WinXPSP3x86, 512 M \\ \hline \multirow{3}{*}{9} & \multirow{3}{*}{Coreflood} & [[https://github.com/volatilityfoundation/volatility/wiki/Memory-Samples](https://github.com/volatilityfoundation/volatility/wiki/Memory-Samples)]([https://github.com/volatilityfoundation/volatility/wiki/Memory-Samples](https://github.com/volatilityfoundation/volatility/wiki/Memory-Samples)). (accessed on 15 March 2021) \\  & & & WinXPSP3x86, 512 M \\ \hline \end{tabular}
\end{table} 
Table 1: Experimental samples.