# SFCWGAN-BiTCN with Sequential Features for Malware Detection
## 4 Experiments and Analysis of Results
### Experimental Results and Analysis
#### 4.3.6 Comparison of Existing Methods  
We compared with existing methods in order to further validate the performance of the SFCWGAN- and BiTCN-based malware detection algorithms. Those were applied to the Kaggle and DataCon datasets according to their published descriptions and parameter settings, and yielded the results shown in Table 11.  
[PERSON] et al. [21] use a LeNet5 structure based on the Word2 Vec multi-channel feature matrix. Due to the diversity and polymorphism of malicious code, the code structure of malware can change significantly, making the model difficult to converge and less accurate. [PERSON] et al. [20] use grayscale images as features and do not take into account the semantic features of binary code, resulting in lower accuracy. [PERSON] et al. [41] feature byte sequences, API function calls, and Opcodes using a LeNet5 structure based on the Word2 Vec multichannel feature matrix but with different colors for different features, which ignores correlation between features. [PERSON] et al. [42] extract features via a CNN model for  
\begin{table}
\begin{tabular}{c c c} \hline \hline
**Reference** & **Method** & **Accuracy/\%** \\ \hline Ref. [20] & CNN + Gray & 97.49 \\ Ref. [21] & LeNet5 + RGB + Word2 Vec & 98.76 \\ Ref. [41] & Byte + Opcode & 98.24 \\ Ref. [42] & Opcode + grayscale map & 99.36 \\ Ref. [43] & Image + CNN and LSTM & 98.5 \\ Ref. [44] & Opcode + image+ segment + other & 99.12 \\ Ref. [45] & Byte sequence + EfficientNet & 97.47 \\ Ref. [46] & API + LSTM + BLSTM & 99.38 \\ Our & CWGAN + BiTCN & 99.56 \\ \hline \hline \end{tabular}
\end{table}
Table 11: Detection accuracy under the influence of difference algorithms on Kaggle dataset.  
Figure 14: The Evaluation Results Based on DataCon Dataset; they should be listed as: (**a**) Description of accuracy; (**b**) Description of loss.  
Figure 13: The Evaluation Results Based on Kaggle Dataset; they should be listed as: (**a**) Description of accuracy; (**b**) Description of loss.  
grayscale maps and LSTM model for Opcode features, then fuse the results for classification. The extracted image features are trained using ResNet and GoogleNet models. [PERSON] et al. [43] uses CNN and LSTM models, respectively, to classify malware image features using migration learning methods. [PERSON] et al. [44] propose an approach with integrated deep learning, feature engineering, image transformation, and processing techniques, and use CNN and XGBoost methods. [PERSON] and [PERSON]'s [45] one-dimensional convolutional neural networks (CNNs) are presented in order to detect and classify malware families. [PERSON] et al.'s work [46] proposes different malware detection techniques based on CNN, LSTM, and bidirectional LSTM models. These models were trained on raw API sequences and parameters traced during the execution of malware and benign executable files.  
These methods did not perform as well as expected for Vundo, Simda, Tracur, and Kelihos_ver1, which are families. In particular, for the Simda family with only 42 samples, the classification accuracy was only 85.92%, mainly because the sample size was too small to obtain accurate family features. Compared these methods, our model uses the SFCWGAN to simplify the feature structure, continues to expand on a few malware family samples, and reduces the impact of malware family sample imbalance, resulting in better detection results. The model uses the BiTCN for feature extraction and classification to extract deeper and more deep-level features from the time series level, resulting in better detection results.