## 5 Experimental Results
### Results
This can be useful in situations where the processing time is a critical factor. The results reported in Figure 7a,b show that the classifiers achieved high performance in the malware categorization task. In particular, the RF classifier performed well on the full features and the selected feature subset, achieving TPRs of 95.6% and 95.8%, respectively. This indicates that the RF classifier can effectively categorize malware samples into their correct family types with high accuracy. It is also worth noting that the performance of the RF classifier improved slightly on the selected feature subset, achieving a higher TPR and accuracy. This suggests that the RF classifier can achieve better performance using a smaller number of features, which can be useful in situations where the number of features is limited. These results indicate that the classifiers could effectively categorize malware samples into their correct family types with high accuracy. The RF classifier showed strong performance on both the full set of features and the selected feature subset, demonstrating its ability to achieve high performance using a smaller number of features. In Table 2, we report the training time taken by the classifiers to learn the hidden patterns in the data and perform multi-class classification. It is important to note that the specific training times reported in Table 2 are specific to the dataset and classifiers used in that particular scenario and may not apply to other datasets or classifiers. Training time can vary widely depending on several factors, such as the size and complexity of the dataset, the type of classifier being used, the number of features in the dataset, and the computing power available. \begin{table}
\begin{tabular}{c c c c c} \hline \hline  & \multicolumn{2}{c}{**Full Features**} & \multicolumn{2}{c}{**Selected Features**} \\ \hline
**Classifiers** & \begin{tabular}{c} **Training** \\ **Time (s)** \\ \end{tabular}  & \begin{tabular}{c} **Testing** \\ **Time (s)** \\ \end{tabular}  & \ \begin{tabular}{c} **Training** \\ **Time (s)** \\ \end{tabular}  & \begin{tabular}{c} **Testing** \\ **Time (s)** \\ \end{tabular}  \\ \hline GN & 0.76 & 0.0000622 & 0.0294 & 0.0000458 \\ \hline MLP & 4736.90 & 0.013 & 63.375 & 0.0000308 \\ \hline KNN & 0.10 & 0.37 & 0.00976 & 0.00476 \\ \hline GB & 1399.86 & 0.0000715 & 9.02 \begin{table}
\begin{tabular}{c c c c c} \hline \hline  & \multicolumn{2}{c}{**Full Features**} & \multicolumn{2}{c}{**Selected Features**} \\ \hline
**Classifiers** & \begin{tabular}{c} **Training** \\ **Time (s)** \\ \end{tabular} & \begin{tabular}{c} **Testing** \\ **Time (s)** \\ \end{tabular} & \
\begin{tabular}{c} **Training** \\ **Time (s)** \\ \end{tabular} &
\begin{tabular}{c} **Testing** \\ **Time (s)** \\ \end{tabular} \\ \hline GN & 0.457 & 0.000303 & 0.0258 & 0.00015 \\ \hline MLP & 123.689 & 0.000185 & 43.586 & 0.0000352 \\ \hline KNN & 0.194 & 0.02194 & 0.0289 & 0.00078 \\ \hline GB & 3352.254 & 0.00025 & 24.910 & 0.000205 \\ \hline LR & 14.31 & 0.0000426 & 3.469 & 0.0000213 \\ \hline LD & 23.379 & 0.0000620 & 0.0954 & 0.0000379 \\ \hline RF & 14.855 & 0.00288 & 1.251 & 0.00280 \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Training and average testing time of all chosen classifiers for malware categorization scenario. Figure 7: Results of different classifiers for malware categorization (**a,b**) problem. (**a**) Full features; (**b**) selected features. In the scenario described, the training time for the classifiers decreased when using selected features rather than the original ones. This may be because fewer features can make the training process more efficient, as the classifier has less information to process. However, it is also possible that the classifier's performance may be affected by using only a subset of the original features, so it is important to carefully evaluate the trade-off between training time and performance when deciding which features to use.