# Detection of Malware by Deep Learning as CNN-LSTM Machine Learning Techniques in Real Time
## 6 Results and Discussion  
The training and testing phases constitute the backbone of any classification method. In order to train the system, it must be exposed to both harmful and safe data [31]. A classifier may be trained using machine learning techniques to automatically generate reliable predictions. With each new set of labeled data, the classifier, the CNN-LSTM model, improves its performance. The classifier is given a collection of new files, some of which are malicious and some of which are not, and is asked to assign a category to each one during the validation phase as shown in Figure 7[32].  
Figure 7 illustrate the CNN-LSTM model. The CNN-LSTM model employs dropout at the last fully connected layer. Dropout does not seem to be a method for regularization as much as it seems to be a way to add layers to the whole model as illustrated in Figure 8[33].  
This section contains the experimental findings from our assessment of the effectiveness of the malware categorization and detection method we suggested [34]. The generated malware and cleanware datasets are used in experiments as shown in in Figure 8. In this work, we look at malware and put it into categories by using supervised machine learning with the CNN-LSTM classifier [35].The results see Figure 9.  
Figure 6: Feature extraction from dataset.  
Model: \"Cnn-Lstm_model\" ________  Layer (type) Output Shape Param # ================================  layer_embedding (Embedding) (None, 100, 8) 2456 ________ batch_normalization (BatchNorm(None, 100, 8) 32  conv1d (Conv1D) (None, 100, 32) 2336 ________ max_pooling1d (MaxPooling1D) (None, 50, 32) 0 ________ lstm (LSTM) (None, 512) 1116160 ________ dense (Dense) (None, 1) 513 ________ Total params: 1,121,497  Trainable params: 1,121,481  Non-trainable params: 16  
Figure 10 illustrates two trending lines: the red line represents the training of the dataset and the blue line represents the validation of the dataset [28]. After balancing the dataset, the precision of the training of the proposed model is 0.95, recall 0.87, and the average weighted accuracy is 99% [36].  
Figure 8: CNN-LSTM model summary.  
Figure 9: CNN-LSTM classifier results.  
precision recall f1-score support  
0 0.90 0.74 0.81 283  
1 0.99 1.00 1.00 10686  
accuracy 0.99 10969 macro avg 0.95 0.87 0.90 10969 weighted avg 0.99 0.99 0.99 10969  
Figure 11 shows the accuracy, recall, and F1 score of the proposed CNN-LSTM model. This study highlights the increasing attention that academics are paying to ML algorithmic approaches for malware detection [37]. Here, we offer a safeguard that uses three distinct machine learning (ML) algorithms to determine which is the most effective in detecting malware. According to the findings, the CNN-LSTM outperforms other classifiers in terms of detection accuracy, with 99% accuracy, 99% precision, 99% recall, and an F1 score of 1 [38].  
Figure 11 helps us visualize the confusion matrix of the CNN-LSTM proposed model. The prevalence and sophistication of malicious software are both on the rise. In this experiment, we compare an ML classifier trained on Python language on Google Colab python compiler [38; 39]. The data sets are analyzed using static analysis against another ML classifier trained on other data sets in order to evaluate and quantify the detection accuracy of each [40]. Thanks to our research, machine learning algorithms can now identify harmful data from safe data. The CNN-LSTM machine learning approach's 99% accuracy was the best of any classifier we tested. The results of the experiments show that proposed CNN-LSTM model for malware detection accuracy is 99% when tested on python language [41].  
Figure 10: CNN-LSTM model report.  
Table 1 illustrates that the CNN-LSTM model has the highest detection accuracy (99%) among the other malware detection methods. DT accuracy is 98% and SVM accuracy is 95%.