# Zero-Day Threat Mitigation via Deep Learning in Cloud Environments
## 5 Results
### Results by Class and Metric Distribution  
The model showed consistently stronger performance in detecting malware (Class 1) compared with benign files (Class 0), largely due to the class imbalance present in the dataset. This limitation was partially mitigated through the application of the Synthetic Minority Oversampling Technique (SMOTE), which allowed for the augmentation of the minority class (benign files) during the training phase. The overall performance underscores the model's effectiveness in scenarios characterized by severe class imbalance [32]. To evaluate the robustness and consistency of the MVT model across various experimental configurations, a comparative analysis was performed using box plots of key classification metrics. Figure 7 presents a comparative assessment of the F1-Score for Class 1 (Malware), obtained under multiple training setups. This metric, which synthesizes both precision and recall, provides a comprehensive measure of the model's capacity to accurately detect malware instances. The analysis highlights the influence of different training strategies on the model's ability to maintain stable and balanced detection performance, identifying the configurations that yield the most robust and reliable results. Figure 7 compares the model's effectiveness in sustaining a high F1-Score under diverse training conditions and data configurations, reflecting its robustness in balancing precision and recall. Additionally, the recall performance across experiments reveals that Experiment 5 attained the highest median recall, indicating superior reliability in correctly identifying malware samples across varying scenarios. Figure 8 shows the precision for Class 1 (Malware) across experiments, highlighting the model's ability to minimize false positives and accurately identify malware under different configurations. Highlights how the model's precision in identifying malware fluctuates with changes in data preprocessing and model parameters. The accuracy remained stable with low variance, suggesting consistent performance regardless of configuration changes. The model demonstrates stable accuracy across experiments, with only slight variations in performance. This consistency suggests that the MVT model maintains reliable overall classification regardless of training variations. Figure 9 presents the recall values for Class 1  
Figure 6: Precision, recall, and F1-Score for Class 1 (Malware) over epochs. (Malware) across experiments, emphasizing the model's effectiveness in correctly detecting malware samples and reducing false negatives under varying configurations. Figure 9 demonstrates the model's ability to correctly identify malware samples under different experimental setups. F1-Score variability in Experiment 5 may reflect sensitivity to parameter adjustments, though overall performance remains balanced. The slightly higher interquartile range in Experiment 5 suggests sensitivity to certain parameter  
Figure 8: Comparison of Precision for Class 1 (Malware) across experiments. Figure 7: Comparison of F1-Score for Class 1 (Malware) across different experiments. Figure 9: Comparison of Recall for Class 1 (Malware) across experiments. configurations. Figure 10 displays the average F1-Score across all experiments, providing an overall assessment of the model's balance between precision and recall and highlighting its consistency and robustness in malware detection. Figure 10 presents the average F1-Score across multiple experimental runs, demonstrating the model's capacity to maintain a stable balance between precision and recall under different configurations. The consistent F1-Score reflects reliable performance in malware classification. Notably, Experiment 5 exhibits the highest recall, further validating its effectiveness in accurately identifying malicious threats without omissions.