## 2 Related Work  
Motivated by the tremendous success of ML techniques in different fields, several ML/DL-based malware detection approaches have been proposed in the recent literature [2; 14; 15; 16; 17; 18; 19; 20]. In this section, we survey the most recent works that adapted machine learning classifiers for malware detection in PE files. Additionally, our survey will be limited to the papers that applied 1D feature classification.  
The study by [PERSON] et al. [2] presents a data mining approach to detect new (previously unseen) malicious executable files. The proposed approach supports multiple methods of feature extraction and incorporates multiple machine learning classifiers. Their created dataset, consisting of 1000 benign and 3265 malicious samples, achieved 97.76% TPR using the Multi-Naive Bayes algorithm as the binary classifier. Similarly, another study [16] also exploits multiple machine learning classifiers, namely, Naive Bayes, J48, Support Vector Machine, and K-Nearest Neighbors for the same reason. On a dataset comprising 1,971 benign and 1,651 malicious samples, they obtained a TPR of 98% at the cost of 0.05% FPR using J48 as the classifier. Another study by [PERSON] et al. [18] proposed a scalable and automated approach for detecting and classifying malware using several machine algorithms and statistical methods used at various stages of the malware analysis life cycle. Using k-fold cross-validation on the malware, which includes Trojans and viruses, along with 151 clean files, the authors achieve an overall classification accuracy of 98.86% using the top-performing Decision Tree as the classifier. Finally, in a recent study [20], the authors proposed a multi-layer hybrid approach, namely, TrojanDetector, to detect the Trojan's abnormal behaviour in Android applications from three different Android levels based on the selected features and then apply multiple classifiers for the evaluation. The authors evaluated their scheme on three publicly available datasets and reported that the Support Vector Machine outperformed its counterparts and attained the highest accuracy of 96.64%.  
Recent studies [14; 17] present the two latest larger datasets, i.e., EMBER and BODMAS, respectively. The EMBER [17] dataset consists of multiple clusters of raw features (including raw features, format-agnostic histograms, and string counts) for training machine learning models in order to detect malicious Windows PE files. Similarly, the BODMAS [14] describe and release an open PE malware dataset called BODMAS to facilitate research efforts in machine learning-based malware analysis. A preliminary analysis to illustrate the impact of concept drift and discuss how this dataset can help to facilitate existing and future research efforts. The Ember dataset is a larger dataset comprising 900K training samples and 200K testing samples (100K benign, 100K malicious) and BODMAS data consists of 57,293 malware samples and 77,142 benign samples, with carefully curated family information (581 families). At the best-selected threshold of 0.871, the study [17] achieves a TPR of 92.99% at an FPR of 0.1%, and at 1% FPR, their model achieves 98.2%TPR. The study [14] investigates the concept drift in malware analysis and applies different approaches; hence, their obtained results are not relevant to this study.  
Our proposed approach, namely, MalwD&C, is different from the previously described machine learning-based malware analysis schemes in the following ways: (i) MalwD&C is a scenario-based approach to detect and categorize every PE file before allowing the authors to install. (ii) Performance evaluation of multiple classifiers regarding training and decision-making time. To the best of our knowledge, we are the first to report the results of such an evaluation. Finally, (iii) MalwD&C attains the highest accuracies of 99.56% and 97.69% in malware detection and categorization scenarios, respectively.