## 3 Methodology
### Feature Extraction
#### 3.4.1 Texture Feature (SFTA)
### Feature Selection

The inspiration behind the employment of the feature selection is to select the most prominent features to refine the accuracy and eliminate the unnecessary features to make the system fast in terms of execution time and increase the accuracy rate. In this paper, from the fused feature vector (FV),principal component analysis (PCA) is used for optimal feature selection. PCA has the following steps: (a) calculating the mean of a fused feature vector, (b) subtracting the mean from each feature, (c) calculating the covariance matrix, and (d) calculating the eigenvalues and eigenvector from covariance matrix. Finally, PCA returns a score value and a principal components score. The first process before applying PCA is normalizing the FV so that it works adequately. It can be done by subtracting the relevant means from the corresponding column in the FV. Let us have FV values denoted by \(x\), and \(N\) is the total number of extracted feature values in FV:

\[x_{0}=\frac{1}{N}\sum\
olimits_{i=0}^{N}x_{i}, \tag{20}\]

\[K_{0}(x_{0})=\sum\
olimits_{i=0}^{n}\left|(x_{0}-x_{1})\right|2, \tag{21}\]

where \(K_{0}\) will be the normalized FV that will be used further for finding the covariance matrix. \[conv(x,y)=\frac{1}{n-1}\sum\limits_{i=1}^{n}(X_{i}-x^{\prime})(Y_{i}-y^{\prime}) \tag{22}\]

The covariance of \(conv(x,y)\) matrix calculates the eigenvectors with their corresponding eigenvalues. The selected optimal features from both models after applying PCA are fused using a parallel-based method and a final fused vector is obtained. ## 4 Results and Analysis

### Dataset

The Malimg [51] dataset (available for download from [[https://www.dropbox.com/s/ep8](https://www.dropbox.com/s/ep8) qjakfwhlrzk4/malimg_dataset.zip]([https://www.dropbox.com/s/ep8](https://www.dropbox.com/s/ep8) qjakfwhlrzk4/malimg_dataset.zip)) consists of malware images that were processed from malware binaries, and we trained the deep learning models to classify each malware family. The dataset comprised of 25 malware families and has 9348 grayscale images. Each family of the Malimg dataset contains a different number of samples, so the dataset is imbalanced (see Figure 6). The dataset has an unfair distribution of classes, for example, 2949 images represent the Allaple malware family, while only 80 images are present in the Skintrim family. The image augmentation techniques are used to stabilize the number of training samples to recover the superiority of data trials. By applying the data augmentation technique, the data imbalance problem is resolved, and each family of malware contains 1000 malware samples. Hence, the number of total images becomes 25,000. Figure 6: Distribution of samples in the Malimg dataset [51]. ### Settings

For classification, we used a support vector machine (SVM) with linear, quadratic, polynomial (cubic), and Gaussian kernels, k-nearest neighbor (KNN) with cosine similarity as distance metrics (cosine KNN), KNN with the count of neighbors set to 1 (fine KNN), KNN with the count of neighbors set to 10 (medium KNN), KNN with the count of neighbors set to 100 (coarse KNN), KNN with distance weighting (weighted KNN), decision tree (DT), DT with the maximum count of splits set to four (fine DT), 20 (medium DT), and 100 (coarse DT), boosted DT, cosine DT, Adaboost classifier, and linear discriminate (LD) classifiers. Each classifier performance is evaluated using recall, error rate (ER), and area under the curve (AUC) and accuracy metrics (Equations (23)-(25)). All experiments were done with MATLAB 2018b (Math Works, Inc., Natick, MA, USA) having machine specifications of 1.00 GHz CPU with 8 GB RAM. \[\text{Recall}=\frac{TP}{TP+FN} \tag{23}\]

\[\text{ER}=\frac{FP+FN}{TP+TN+FP+FN} \tag{24}\]

\[\text{Accuracy}=\frac{TP+TN}{TP+TN+FP+FN} \tag{25}\]

### Results

We use the multi-representation of various features and selection methods incorporated to obtain diverse classifier results to verify the efficiency of the proposed method.