# MLMD--A Malware-Detecting Antivirus Tool Based on the XGBoost Machine Learning Algorithm
## 2 Theoretical Background
### Reference Works
When applying the algorithm to features obtained by dynamic analysis only, the detection accuracy was slightly worse, specifically 97.1%. Considering static analysis, the detection accuracy was 95.88%. Thus, the achieved results showed that the combination of static and dynamic analysis increased the detection accuracy compared to the use of static and dynamic analysis alone. The use of dynamic analysis techniques to extract features was also discussed by [PERSON] et al. [21], who used the open-source Anubis tool for dynamic analysis. In their work, these authors used and compared a total of five machine learning algorithms--notably NB, SVM, MLP, KNN, and J48--in several experiments. They found the J48 algorithm to be the best (having a 96.8% detection accuracy) and the NB algorithm to be the worst (having a 62.8% detection accuracy). [PERSON] et al. [22] used the Cuckoo Sandbox, an automated dynamic malware analysis system, to extract features from memory dumps, which are produced during the execution of the samples. They compared the accuracies of three algorithms: KNN, SVM, and RF. They obtained the best detection accuracy using the RF algorithm, namely 91.4%. The worst results (91% detection accuracy) were obtained using the KNN algorithm. [PERSON] and [PERSON] [23] proposed a malware classification scheme that constructs a model using low-end computing resources and a very large balanced dataset--the EMBER dataset, which consists of 1.1 million entries--for malware. The authors compared the performance of nine algorithms: Gaussian NB, KNN, linear support vector classification (SVC), DT, AdaBoost, RF, extra trees, gradient boost (GDB), and XGBoost. In their experiments, XGBoost outperformed the other algorithms. Therefore, the authors built the final classifier based on XGBoost. Their hyperparameter-tuned model has an accuracy of 98.5% and AUC of 0.9989. This research is unique and significant because it uses an entire dataset with XGBoost using gradient boost decision tree (GBDT) algorithm to get matching or higher accuracy with low computing resources. The NB, DT, RF, GDB, and XGBoost algorithms were used for developing the classification model for malware detection in the research of [PERSON] and [PERSON] [24]. They considered five approaches to find out the discerning features for classification. Four approaches were based on the presence of features in malware and/or benign files. The authors, in their fifth approach, use feature selection methods, namely the chi-square, mutual information, and extra trees classifiers. The features obtained from these three classifiers were combined to form a feature set in this approach. The best detection accuracy was 99.5% for both RF and XGBoost. [PERSON] et al. [25] applied seven learning algorithms on a benchmark dataset in their experiments, namely KNN, SVM, Bernoulli NB, RF, DT, logistic regression (LR), and hard voting (HV) on particular classification algorithms: LR, SVM, Bernoulli NB, and DT. This paper shows that the highest accuracy was achieved by DT, with a score 98.2% for binary classification and 95.8% by RF for multi-class classification. The lowest accuracy was achieved by Bernoulli NB, with an accuracy of 91% and 81.8% for binary classification and multi-class classification, respectively. An overview of the existing works is available in Table 1.