# MLMD--A Malware-Detecting Antivirus Tool Based on the XGBoost Machine Learning Algorithm
## 3 Design Methods
### Choosing the Best Model  
Using several metrics, we compared the best results with the results of our previous works, in which we compared multiple algorithms--RF, DT, SVM, and NB--on the same dataset. \begin{table}
\begin{tabular}{c c c c c c} \hline \hline \multirow{2}{*}{**Parameters**} & **Classification Accuracy (\%)** & **Sensitivity (\%)** & **Specificity (\%)** & **ROC AUC** & **F1** \\ \hline ET\_S\_1 & \(91.786\pm 0.697\) & \(97.176\pm 0.890\) & \(74.067\pm 3.107\) & \(0.856\pm 0.014\) & \(0.948\pm 0.017\) \\ ET\_S\_2 & \(91.775\pm 0.623\) & \(97.322\pm 0.817\) & \(73.541\pm 3.326\) & \(0.854\pm 0.014\) & \(0.948\pm 0.016\) \\ ET\_S\_3 & \(91.774\pm 0.625\) & \(97.489\pm 0.845\) & \(72.990\pm 3.239\) & \(0.852\pm 0.014\) & \(0.948\pm 0.017\) \\ ET\_S\_4 & \(91.769\pm 0.650\) & \(97.445\pm 0.853\) & \(73.110\pm 3.295\) & \(0.853\pm 0.014\) & \(0.948\pm 0.016\) \\ ET\_S\_5 & \(91.769\pm 0.676\) & \(97.198\pm 0.838\) & \(73.923\pm 3.403\) & \(0.856\pm 0.015\) & \(0.948\pm 0.017\) \\ \hline \hline \end{tabular}
\end{table} 
Table 6: Best results for the _extremely randomized trees_ algorithm (static analysis). \begin{table}
\begin{tabular}{c c c c c c} \hline \hline \multirow{2}{*}{**Parameters**} & **Classification Accuracy (\%)** & **Sensitivity (\%)** & **Specificity (\%)** & **ROC AUC** & **F1** \\ \hline ET\_D\_1 & \(96.387\pm 0.685\) & \(98.165\pm 0.497\) & \(90.281\pm 2.302\) & \(0.942\pm 0.012\) & \(0.977\pm 0.010\) \\ ET\_D\_2 & \(96.375\pm 0.530\) & \(98.039\pm 0.525\) & \(90.663\pm 1.753\) & \(0.944\pm 0.009\) & \(0.977\pm 0.010\) \\ ET\_D\_3 & \(96.375\pm 0.540\) & \(98.202\pm 0.568\) & \(90.102\pm 1.530\) & \(0.942\pm 0.008\) & \(0.977\pm 0.011\) \\ ET\_D\_4 & \(96.375\pm 0.705\) & \(98.016\pm 0.495\) & \(90.740\pm 2.229\) & \(0.944\pm 0.012\) & \(0.977\pm 0.010\) \\ ET\_D\_5 & \(96.375\pm 0.605\) & \(97.875\pm 0.510\) & \(91.224\pm 1.832\) & \(0.945\pm 0.010\) & \(0.977\pm 0.010\) \\ \hline \hline \end{tabular}
\end{table} 
Table 7: Best results for the _extremely randomized trees_ algorithm (dynamic analysis). \begin{table}
\begin{tabular}{c c c c c c} \hline \hline \multirow{2}{*}{**Parameters**} & **Classification Accuracy (\%)** & **Sensitivity (\%)** & **Specificity (\%)** & **ROC AUC** & **F1** \\ \hline XGB\_1 & \(91.920\pm 0.658\) & \(98.253\pm 0.472\) & \(71.100\pm 3.051\) & \(0.847\pm 0.014\) & \(0.949\pm 0.009\) \\ XGB\_2 & \(91.914\pm 0.617\) & \(98.508\pm 0.380\) & \(70.239\pm 2.762\) & \(0.844\pm 0.013\) & \(0.949\pm 0.008\) \\ XGB\_3 & \(91.897\pm 0.609\) & \(98.231\pm 0.426\) & \(71.077\pm 2.980\) & \(0.847\pm 0.014\) & \(0.949\pm 0.008\) \\ XGB\_4 & \(91.858\pm 0.635\) & \(98.464\pm 0.452\) & \(70.143\pm 3.048\) & \(0.843\pm 0.014\) & \(0.949\pm 0.009\) \\ XGB\_5 & \(91.853\pm 0.717\) & \(97.584\pm 0.492\) & \(73.014\pm 3.338\) & \(0.853\pm 0.016\) & \(0.948\pm 0.010\) \\ \hline \hline \end{tabular}
\end{table} 
Table 8: Best results for the _XGBoost_ algorithm (static analysis). \begin{table}
\begin{tabular}{c c c c c c} \hline \hline \multirow{2}{*}{**Parameters**} & **Classification Accuracy (\%)** & **Sensitivity (\%)** & **Specificity (\%)** & **ROC AUC** & **F1** \\ \hline XGB\_1 & \(91.920\pm 0.658\) & \(98.253\pm 0.472\) & \(71.100\pm 3.051\) & \(0.847\pm 0.014\) & \(0.949\pm 0.009\) \\ XGB\_2 & \(91.914\pm 0.617\) & \(98.508\pm 0.380\) & \(70.239\pm 2.762\) & \(0.844\pm 0.013\) & \(0.949\pm 0.008\) \\ XGB\_3 & \(91.897\pm 0.609\) & \(98.231\pm 0.426\) & \(71.077\pm 2.980\) & \(0.847\pm 0.014\) & \(0.949\pm 0.008\) \\ XGB\_4 & \(91.858\pm 0.635\) & \(98.464\pm 0.452\) & \(70.143\pm 3.048\) & \(0.843\pm 0.014\) & \(0.949\pm 0.009\) \\ XGB\_5 & \(91.853\pm 0.717\) & \(97.584\pm 0.492\) & \(73.014\pm 3.338\) & \(0.853\pm 0.016\) & \(0.948\pm 0.010\) \\ \hline \hline \end{tabular}
\end{table} 
Table 9: Best results for the _XGBoost_ algorithm (dynamic analysis). Table 10 shows a comparison of the best results for each of the algorithms implemented herein and in our previous work [32], using the dataset obtained by static analysis of the samples using Dependency Walker.