## 5 Experiment Description  
A _logistic regression model_ was built in Python using Scikit-learn [34]. The dataset file was prepared as follows. The sample_id column was removed to prevent it from influencing the model. Malicious samples were analysed first during sample analysis, followed by benign samples. The sample_id was taken from the Task ID generated by the Cuckoo Sandbox software and used as the primary key in the samples database table. Consequently, all malicious samples had a sample_id of 830 or less, and all benign samples had a sample_id of greater than 830. The sample_id column would have undoubtedly influenced the model, invalidating it if not removed. Labels were extracted from the is_malicious column into a separate array and dropped from the dataset. The complete dataset was split into training and testing sets with a ratio of 80:20, using Scikit-learn's train_test_split functionality. Training data features were scaled using a StandardScaler, which centers the data around its mean and scales by its standard deviation. Each feature value is scaled according to the formula (Formula (5)).  
\[Z=\frac{(x-u)}{\sigma} \tag{5}\]  
Formula (5): StandardScaler formula.  
Where \(x\) is the observed value of a feature, \(u\) is the mean value of the feature across all examples, and \(\sigma\) is the standard deviation of the feature values. The logistic regression model was trained on the scaled data and tested using a version of the test data that had been scaled using the same StandardScaler instance used to mount the training data, described in Section 3.  
For _Support Vector Machine_ the dataset was prepared and split similarly to the logistic regression model, and a series of SVM models were built using Scikit-learn's SVC classifier. Four models were created using the Radial Basis Function (RBF), Linear, Polynomial, and Sigmoid kernel functions.  
After the preparation and splitting of the dataset, a _K-Nearest Neighbours_ model was built using Scikit-learn's KNeighborsClassifier. The algorithm selection was left at the default of 'auto', which selects a brute-force algorithm for determining the distances between neighbours. The k-value was set to the default value of 5.  
For the _Decision Tree_ model, similarly to the logistic regression model, the dataset was loaded from a CSV file and prepared by removing the sample_id column, extracting labels, and scaling features using a StandardScaler. The dataset was then split into a training set (80%) and a testing set (20%).  
The model was built using Scikit-learn's DecisionTreeClassifier and trained using the training data. The model's performance was evaluated against both the training and testing data. Suspicions of overfitting were investigated, and a revised model was subsequently built.  
The dataset was loaded and prepared similarly to the logistic regression and decision tree models for the Random Forest model. A random forest model was built using the Scikit-learn RandomForestClassifier, trained, and had its performance evaluated against training and testing data.  
The dataset was prepared, scaled, and split for the Artificial Neural Network model as before. Tensorflow was used to create a neural network which could then be trained and evaluated. The network's configuration was as follows: input layer--284 units (to match the number of input features); activation function--Rectified Linear Unit; hidden layer--experiments were conducted with a hidden layer of 16 units (NN-16), 64 units (NN-64), and 128 units (NN-128); output layer--1 unit with activation function: sigmoid. The activation function was Rectified Linear Unit in each case.  
The model was trained for 100 epochs, and metrics were calculated. Regarding the metrics such as accuracy, precision, and the area under the ROC curve, there was little difference between the NN-16 and NN-64 networks, and the metrics were slightly worse for NN-128. Further developments of the neural network model continued to use 16 units in the hidden layer.