# Binary and Multi-Class Malware Threads Classification
## 5 Results and Discussion
### Evaluation Results
#### 5.3.2 Multi-Class Malware Classification Results  
We make an effort to group the malware samples into the appropriate families in order to produce multiclass classification findings. The MaleVis dataset contains 25 malware families, thus we have 25 classes to use for this classification issue. Table 4 shows the collected results for each malware family, as well as the overall average of accuracy metric that was determined after applying each classifier. The multi-class malware classification results using the SFTA-GDA, SFTA-NB, Gabor-GDA, and Gabor-NB are shown in Table 4.  
According to the average accuracy results on the MaleVis dataset, the performance of the SFTA-GDA attained a high average accuracy rate of 98%. Meanwhile, the average accuracy rate for Gabor-GDA was 95%. Additionally, it is clear that the SFTA-NB outperformed Gabor-NB on the MaleVis dataset by reaching a high classification average accuracy of 87% as opposed to 82%. The maximum classification accuracy was achieved by SFTA-GDA and SFTA-NB for both classifiers. However, the performance of the SFTA-GDA attained a high accuracy rate of 98%. Meanwhile, the accuracy rate of SFTA-NB was 87 percent as shown in Figures 9 and 10.  
As can be seen, when the NB classifier is employed with SFTA and Gabor texture descriptors, its performance suffers when classifying malware images. For ten different families in the MaleVis Dataset, the accuracy ranges from 52% to 73%. However, when the GDA classifier was employed with SFTA and Gabor texture descriptors, its performance significantly improved when classifying malware images. For all families in the MaleVis Dataset, the accuracy ranges from 94% to 99%.  
As can be observed, the performance of SFTA-NB ranges from 61% to 73% for the four different families (BrowseFox, Expiro, VBKrypt, and Injector). Additionally, the performance of Gabor-NB for seven different families (Agent, Amonetize, Androm, Dinwod, Expiro, MultiPlug, and Neoreklami) ranges from 52% to 70%. However, the performance of SFTA-GDA has greatly increased and currently varies from 96% to 99% for all families. Moreover, the performance of Gabor-GDA has greatly improved and now ranges from 94% to 99% for all families as demonstrated in Table 4.  
Figure 8: Detection Accuracy Rate of Proposed Method.  
In the majority of recent works such [36], the Neshta class, which is a member of the virus family, had the lowest accuracy. However, the SFTA-NB, Gabor-NB, SFTA-GDA, and Gabor-GDA methods achieved better classification accuracy, specifically for the Neshta class, at 87%, 82%, 98%, and 95%, respectively.  
The findings demonstrate that the GDA classifier, when combined with SFTA features, has an important effect, particularly in some classes, such as (BrowseFox, Expiro, VBKrypt, and Injector), whose overall accuracy increased from 61%, 66%, 73%, 62% to 99%, 99%, 99%, 97%. It is obvious that using a GDA classifier greatly enhances the results.  
It can be concluded that employing SFTA-GDA, the accuracy is seen to be greatly enhanced for all families of the MaleVis Dataset.  
Figure 10: The classification Accuracy-based SFTA and Gabor features across GDA Classifier.  
Figure 9: The classification Accuracy-based SFTA and Gabor features across NB Classifier.