# Binary and Multi-Class Malware Threads Classification
## 5 Results and Discussion
### Evaluation Results
#### 5.3.1 Binary Malware Classification Results  
For Binary Classification Results, we employ binary classification of malware against Non-malware (benign), where the malware class is easily generated by combining all MaleVis families into a single malware set. Whereas, another class is configured to be benign (non-malware).  
After using the two texture descriptors SFTA and Gabor features on the MaleVis datasets for feature extraction, the NB and GDA classifiers are used in this instance for binary classification. In other words, the experiments were carried out for binary classification (malware or Non-malware (benign)) under the MaleVis dataset. The Detection Rate results of the proposed SFTA-GDA, SFTA-NB, Gabor-GDA, and Gabor-NB are shown in Table 3.  
All classifiers use the exact same feature vector, however they all produce different results. This is so because every classifier has a distinct set of characteristics. The accuracy findings on MaleVis dataset in Table 3 indicate that the performance of the SFTA-GDA attained a high accuracy rate of 97%. Whereas, the accuracy rate of Gabor-GDA was 93%. Furthermore, it is evident that the SFTA-NB performed much better on the MaleVis dataset, achieving a high classification accuracy of 84% compared to Gabor-NB which was 83%.  
\begin{table}
\begin{tabular}{c c c} \hline \hline \multirow{2}{*}{**Classifier**} & \multicolumn{2}{c}{**Detection Accuracy (\%)**} \\ \cline{2-3}  & **SFTA Feature** & **Gabor Feature** \\ \hline NB & 84 & 83 \\ GDA & 97 & 93 \\ \hline \hline \end{tabular}
\end{table}
Table 3: Detection Accuracy Rate of two classifiers on two features across MaleVis dataset.  
For both of classifiers, SFTA-GDA and SFTA-NB had the highest detection accuracy. However, the performance of the SFTA-GDA attained a high accuracy rate of 97%. In contrast, the accuracy rate of SFTA-NB was 84 percent as shown in Figure 8. For this reason, we considered the suggested technique based on SFTA and GDA classifier in the initial findings section of this work. The above results are presented for the Binary Classification, while the findings from the multiclass classification are presented in the next section.  
\begin{table}
\begin{tabular}{c c c c c c} \hline \hline \multirow{3}{*}{**Class ID**} & \multirow{3}{*}{
\begin{tabular}{c} **Family** \\ **Name** \\ \end{tabular} } & \multicolumn{3}{c}{**Classification Accuracy (\%)**} \\ \cline{3-6}  & & \multicolumn{2}{c}{**Naive Classifier**} & \multicolumn{2}{c}{**GDA Classifier**} \\ \cline{3-6}  & & **SFTA** & **Gabor** & **SFTA** & **Gabor** \\  & & **Feature** & **Feature** & **Feature** & **Feature** \\ \hline \#1 & Adposhel & 97 & 90 & 99 & 94 \\ \hline \#2 & Agent & 89 & 52 & 99 & 96 \\ \hline \#3 & Allaple & 76 & 78 & 98 & 97 \\ \hline \#4 & Amonetize & 89 & 62 & 99 & 96 \\ \hline \#5 & Androm & 84 & 52 & 97 & 95 \\ \hline \#6 & Autorun & 84 & 94 & 98 & 96 \\ \hline \#7 & BrowseFox & 61 & 95 & 99 & 95 \\ \hline \#8 & Dinwod & 89 & 55 & 97 & 96 \\ \hline \#9 & Elex & 95 & 80 & 98 & 95 \\ \hline \#10 & Expiro & 66 & 58 & 99 & 95 \\ \hline \#11 & Fasong & 98 & 94 & 96 & 95 \\ \hline \#12 & HackKMS & 97 & 99 & 99 & 98 \\ \hline \#13 & Hlux & 99 & 98 & 99 & 99 \\ \hline \#14 & Injector & 73 & 88 & 99 & 95 \\ \hline \#15 & InstallCore & 99 & 99 & 96 & 96 \\ \hline \#16 & MultiPlug & 88 & 66 & 97 & 96 \\ \hline \#17 & Neoreklami & 87 & 70 & 99 & 96 \\ \hline \#18 & Neshta & 95 & 95 & 99 & 97 \\ \hline \#19 & Regrun & 94 & 91 & 99 & 95 \\ \hline \#20 & Sality & 95 & 80 & 99 & 95 \\ \hline \#21 & Sarnasite & 99 & 99 & 99 & 95 \\ \hline \#22 & Stantinko & 83 & 85 & 99 & 93 \\ \hline \#23 & VBA & 85 & 95 & 99 & 98 \\ \hline \#24 & VBKrypt & 62 & 96 & 97 & 95 \\ \hline \#25 & Vilsel & 99 & 99 & 99 & 99 \\ \hline \multicolumn{2}{c}{Average} & 87 & 82\% & 98\% & 95\% \\ \hline \hline \end{tabular}
\end{table}
Table 4: Classification Accuracy rate of two classifiers on two features across MaleVis Dataset.