# Malware Detection Using Memory Analysis Data in Big Data Environment
## 4 Material and Methods
### Data Preprocessing  
To make the dataset suitable for classification, some preprocessing steps are required. These processes are important to improve the efficiency of classification models, as well as to bring the data into a suitable format for the use of machine learning and deep learning algorithms. In addition, some data balancing operations are performed against the \begin{table}
\begin{tabular}{c c c} \hline \hline
**ID** & **Modul.Feature\_Name** & **Description** \\ \hline
31 & malifind.uniqueInjections & Total number of unique injections \\
32 & psxview.not\_in\_pslist & Total number of processes not found in the pslist \\
33 & psxview.not\_in\_epprocess\_pool & Total number of processes not found in the psscan \\
34 & psxview.not\_in\_epthread\_pool & Total number of processes not found in the thrdproc \\
35 & psxview.not\_in\_pspcid\_list & Total number of processes not found in the pspcid \\
36 & psxview.not\_in\_ssrs\_handles & Total number of processes not found in the csrss \\
37 & psxview. not\_in\_session & Total number of processes not found in the session \\
38 & psxview. not\_in\_deskthrd & Total number of processes not found in the desktrd \\
39 & psxview.not\_in\_pslist\_false\_avg & Average false ratio of the process list \\
40 & psxview.not\_in\_epprocess\_pool\_false\_avg & Average false ratio of the process scan \\
41 & psxview.not\_in\_thread\_pool\_false\_avg & Average false ratio of the third process \\
42 & psxview.not\_in\_pspcid\_list\_false\_avg & Average false ratio of the process id \\
43 & psxview.not\_in\_cssrs\_handles\_false\_avg & Average false ratio of the csrss \\
44 & psxview.not\_in\_session\_false\_avg & Average false ratio of the session \\
45 & psxview.not\_in\_deskthrd\_false\_avg & Average false ratio of the deskthrd \\
46 & modules.nmodules & Total number of modules \\
47 & svsccan.services & Total number of services \\
48 & svsccan.kernel\_drivers & Total number of kernel drivers \\
49 & svsccan.fs\_drivers & Total number of file system drivers \\
50 & svsccan.process\_services & Total number of Windows 32 owned processes \\
51 & svsccan.shared\_process\_services & Total number of Windows 32 shared processes \\
52 & svsccan.interactive\_process\_services & Total number of interactive service processes \\
53 & svsccan.native & Total number of actively running service processes \\
54 & callbacks.ncallbacks & Total number of callbacks \\
55 & callbacks.nannonymous & Total number of unknown processes \\
56 & callbacks.ngeneric & Total number of generic processes \\
57 & Class & Benign or Malware \\ \hline \hline \end{tabular}
\end{table} 
Table 2: _Cont._ \begin{table}
\begin{tabular}{c c c} \hline \hline
**Malware Category** & **Malware Families** & **Count** \\ \hline Trojan Horse & Zeus & 1950 \\  & Emotet & 1967 \\  & Refroso & 2000 \\  & Scar & 2000 \\  & Reconyc & 1570 \\ Spyware & 180 Solutions & 2000 \\  & Coolwebsearch & 2000 \\  & Gator & 2200 \\  & Transponder & 2410 \\  & TIBS & 1410 \\ Ransomware & Conti & 1988 \\  & Maze & 1958 \\  & Pysa & 1717 \\  & Aka & 2000 \\  & Shade & 2128 \\ \hline \hline
**Total** & & **29,298** \\ \hline \hline \end{tabular}
\end{table} 
Table 3: Malware samples used in the classification training and testing. overfitting problem, especially in deep learning approaches. However, the CIC-MalMem-2022 dataset used in the study is a balanced dataset and consists of two classes, benign and malware. It is a dataset that is resistant to the overfitting problem because the dataset is balanced. Therefore, no action was taken for the overfitting problem in the study. In this study categorical class values were converted to numerical values using Label Encoder. With the Label Encoder process, each categorical value is randomly assigned to a different numerical value, starting from zero.