## 3 Proposed Method
### ML Algorithms  
Machine learning algorithms suitable for binary classification problems [36] include Logistic Regression, Support Vector Machine, K-Nearest Neighbours, Decision Trees, Random Forests, and Artificial Neural Networks. Although linear regression is suitable for predicting a continuous quantitative value based on one or multiple features, it is not a practical approach for classifying samples as either benign or malicious. Still, it can stand as a valuable technique in understanding _Logistic Regression_. In contrast to linear, the logistic regression analysis method is specifically designed to predict a binary outcome. Based on an S-shaped curve generated by a sigmoid function (Formula (1)), a logistic regression model can determine the probability that the outcome lies in each of the two categories. \(\beta_{0}\) is the bias that determines where the curve crosses the \(y\)-axis: positive values move the curve to the left, and negative values move it to the right. \(\beta_{1}\) is the weight applied to feature x; this weight governs the rate at which p transitions from 0 to 1, with higher values giving a steeper gradient and sharper transition. \[p=\frac{e^{\beta_{0}+\beta_{1}x}}{1+e^{\beta_{0}+\beta_{1}x}} \tag{1}\]  
Formula (1): sigmoid function. By adapting the linear regression approach, the formula can be extended for multiple features as follows (Formula (2)):  
\[p=\frac{e^{\beta_{0}+\beta_{1}x+\beta_{2}x_{2}+\dotsb\beta_{n}x_{n}}}{1+e^{ \beta_{0}+\beta_{1}x+\beta_{2}x_{2}+\dotsb\beta_{n}x_{n}}} \tag{2}\]  
Formula (2): Logistic Regression sigmoid function. Various statistical techniques can also be used to assess the goodness-of-fit of a logistic regression model, including the Pearson Chi-Square statistic and the Hosmer-Lemeshow test [37]. Support Vector Machines are considered particularly appropriate for datasets with a large number of features [38]. A dataset with two features could be visualised as a 2D graph in which the boundary is calculated to separate the two classes and maximise the margin between them. If more than two features are present, a hyperplane is calculated, similarly separating the two classes. Evaluation of examples against this hyperplane is then used to determine the classification. The _K-Nearest Neighbours_ can plot the values of training example features and attempt to classify new examples by determining the classification of the k-nearest examples seen in training [39]. The distance from the test example to its nearest neighbours is usually calculated as a Euclidean distance. If, for instance, the majority of the test example's five nearest neighbours are positive, the test example's classification would also be positive. Decision trees have long been used as a manual aid to decision-making, for instance, in clinical diagnosis [40]. Like flowcharts, a decision tree consists mainly of decision nodes (leaves), each with two possible outputs--malicious or not. While decision trees are easy to comprehend, they have some disadvantages. They can be prone to over-fitting-reflecting the particular characteristics of training data too closely and therefore becoming less effective for making predictions [41]. Anomalous outliers can also unduly influence them in training data [42]. To overcome the disadvantages of Decision Trees, [PERSON] [43] developed _Random Forests_. A Random Forest consists of a number of decision trees, each trained on either a subset of training examples (bagging) or a subset of features. A voting mechanism is then used to determine the final classification based on the results of multiple trees. [PERSON] uses the Strong Law of Large Numbers to show that Random Forests are not susceptible to overfitting and are not unduly influenced by outliers in the training data. _Artificial Neural Networks_ consist of a series of layers--an input layer, a hidden layer, and an output layer. Each layer consists of several nodes that take a number of inputs, perform a calculation, and produce one output.