# Malware Detection Using Memory Analysis Data in Big Data Environment
## 4 Material and Methods
### Machine Learning and Deep Learning Algorithms
Apache Spark MLlib is only supported for binary classification. **Linear Support Vector Machine (Linear SVC):** It is a supervised machine learning algorithm. Each data point is plotted in a space of equal size to the number of features. As seen in Figure 5, classification is made by separating the data of one class from the others with a drawn hyper-plane. The training samples are called support vectors. Margins defined by support vectors define the hyperplane [46]. Apache Spark MLlib supports Linear SVC for binary classification only. The OneVsRest approach is used for multiclass classification. Figure 4: Gradient Boosted Tree Iterations. Figure 3: Sigmoid Function. **Multilayer Perceptron (MLP):** It is a kind of feed-forward neural network. It has a structure consisting of an input layer, hidden layer, and output layer. The output layer must be equal to the number of classes. It has a supervised trained structure that uses labeled data. The multilayer perceptron is generally used when there are a large amount of labeled data [48]. Multilayer Perceptron is also a supported algorithm in Spark MLlib. **Deep Neural Network (DNN):** As seen in Figure 6, it is a feed-forward neural network with multiple hidden layers. It is widely used in supervised and unsupervised learning and for classification and clustering. Deep Neural Networks compute the input sequentially across layers. The output vector in each layer creates the input vector for the next layer. The units in the tiers are multiplied by the current weight coefficient to produce a weighted total. The determined activation function determines the output value by applying the weighted sum obtained [48]. **Long Short-Term Memory (LSTM):** It is a type of Recurrent Neural Network (RNN). It is designed to solve the disappearing gradient and long-term dependency problems in RNN. It has feedback connections. In this way, it keeps the sequential data in its memory and remembers the information for a long time. Unlike RNN, LSTM cells contain four interactive layers. Figure 7 shows the interactive layers in the LSTM cell. Each cell has three different gates. The gateway is the gate that updates the cell status at a given moment. The exit gate is the gate that determines the next cell's input at a given moment. The forget gate is the gate that decides whether data will be forgotten or not, depending on the situation of the cell at a certain moment. The mathematical formulas for these gates are as follows. \[\text{Input Gate }(\text{i}_{\text{t}})=\text{ }\sigma_{\text{g}}(\text{W}_{ \text{i}}\text{x}_{\text{t}}+\text{ }\text{U}_{\text{i}}\text{h}_{\text{t}-1}+\text{b}_{\text{i}}) \tag{3}\]  
\[\text{Output Gate }(\text{o}_{\text{t}})=\text{ }\sigma_{\text{g}}(\text{W}_{ \text{o}}\text{x}_{\text{t}}+\text{ }\text{U}_{\text{o}}\text{h}_{\text{t}-1}+\text{b}_{\text{o}}) \tag{4}\]  
\[\text{Forget Gate }(\text{f}_{\text{t}})=\text{ }\sigma_{\text{g}}(\text{W}_{ \text{f}}\text{x}_{\text{t}}+\text{ }\text{U}_{\text{f}}\text{h}_{\text{t}-1}+\text{b}_{\text{f}}) \tag{5}\]  
\[\mathbf{P}(\mathbf{A}|\mathbf{B})=\frac{\mathbf{P}(\mathbf{B}|\mathbf{A}) \mathbf{P}(\mathbf{A})}{\mathbf{P}(\mathbf{B})} \tag{2}\]0 Support Vector Machine Algorithm. \[\mathbf{P}(\mathbf{A}|\mathbf{B})=\frac{\mathbf{P}(\mathbf{B}|\mathbf{A}) \mathbf{P}(\mathbf{A})}{\mathbf{P}(\mathbf{B})} \tag{2}\]1 Feed-Forward Neural Network Architecture.