**Comparison of Malware Detection Model using Supervised Machine Learning Algorithms** \*\*This is a Double-blind review, please do not include authors information in this version \*\* Received Date: \*date Accepted Date: \*date Published Date: \*date **HIGHLIGHTS** - The malware nowadays is getting advanced and hard to be detected by the malware detection. - Machine Learning algorithm techniques have grown in popularity among researchers for analysing malware detection. - Focus on the machine learning scripting to create the algorithms for detection model. - The highest percentage detection accuracy will be the best supervised machine learning algorithm for being malware detection on this Windows malware dataset. ABSTRACT *Because of various security concerns and cyberattacks, cybersecurity is crucial in today's environment. In addition, malware has evolved quickly in recent years. Machine learning is utilised for malware detection with the advancement of malware analysis. The comparison of malware detection model utilising supervised machine learning techniques is the main goal of this project. The objective of this project is to develop the Windows malware detection model using supervised machine learning in Decision Tree, K-NN, Naïve Bayes, Random Forest and Neural Network, to evaluate the performance of malware detection in term of testing and training of the features selection and to compare the accuracy detection model in all three machine learning algorithms. The Windows malware dataset has been trained and tested by these three machine learning algorithms to get the percentage detection accuracy. Then, the outcomes demonstrated that the best classifier for categorizing our data with 0.96% accuracy is the Random Forest machine learning algorithm. When comparing the accuracy of a malware detection model, it is excellent if there are numerous machine learning algorithms and more malware datasets included.* *Keywords: malware; machine learning; detection accuracy; machine learning algorithm; malware detection model* # INTRODUCTION People nowadays use the internet for a variety of purposes, including shopping, watching videos, listening to music, and even filing taxes. It is no secret that the World Wide Web's quick expansion over the last two decades has brought us fantastic things and given us the ability to do our tasks from the comfort of our own homes or offices. But, as with many excellent things, there is always the other side, which is not always so nice. Cybersecurity is the term that most people are not familiar with or are not interested in because it can be complicated. The basic purpose of cybersecurity is to secure the user, their data, and any other sensitive information that should be kept away from nosy eyes. However, if people nowadays unaware of the importance of cybersecurity and neglect to take preventative precautions, they are likely to have problems. Those issues can lead to situations that are not only difficult to resolve, but also put the safety in jeopardy. Examining the repercussions of situations where cybersecurity was lacking is the greatest way to determine why we need cybersecurity in the first place. The company cannot defend itself against data breach operations without a cybersecurity programme, making it an easy target for fraudsters. The attacker uses the dangerous weapon to harm or steal the personal information of the target user which is called malware. The evolution of malware has been changed rapidly. Malware-based cyberattacks are used in the banking sector, for example, to automate the process of penetration into the targeted organization's IT systems (Irfan, Ariffin, Naz & Anuar, 2020). The cybersecurity needs to make a malware analysis to study and gain information of the dangerous malware nowadays. Because of the rising number of malware attacks on computers and networks, researchers are concentrating their efforts in the field of malware detection and analysis (Samy, Magalingam, Fadillah, Ariffin, & Khairudin, 2018). Malware analysis can help cybersecurity by determining whether a suspicious file is harmful, studying its origin, method, capabilities, and impact, and assessing its impact to aid detection and prevention. Malware analysis is the study or process of determining the functionality, origin and potential impact of a given malware sample such as a virus, worm, trojan horse, rootkit, or backdoor. Also, malware analysis is the process of determining how a suspicious file or URL behaves and what its aim is. The analysis' output aids in detecting and mitigating the potential hazard. Machine learning is a type of data analytics that allows computers to do specific jobs without being given explicit instructions. In recent years, machine learning capabilities have been employed to create both static and dynamic malware detection algorithms. Machine learning is widely used in the field of cybersecurity and there are several different machine learning algorithms available for research, including decision tree and logistic regression, to name but a few. Static analysis of malware involves inspection of the code at rest and has been shown to be successful in the classification of malware family. In this project, we use the different supervised machine learning such as Random Forest, Neural Network, Decision Tree, K- NN and Naïve Bayes as the detection model to make the static analysis on Windows malware. The traditional method cannot manage and become lack for detection of malware and weaker in security of the protection malware (Selamat, Hani & Ali, 2019). To cope the advance malware behavioural from getting to spread in the system can be protected by using the machine learning. Machine learning is an advanced of malware analysis to make a better defence system especially for detection of malware (Zakaria, Abdollah, Mohd & Ariffin, 2017). Previous researcher has developed and analysed machine learning for detection model on existing malware to get the percentage accuracy static analysis effectively by using the different supervised machine learning. Decision Tree Machine Learning is one of the best of machine learning that has the highest accuracy percentage (Selamat, Hani & Ali, 2019). However, there are a lot of supervised machine learning that can be used as the malware detection model. Therefore, this research proposes the comparison of malware detection model using supervised machine learning algorithms which are Neural Network, Random Forest, Decision Tree, K-NN and Naïve Bayes Machine Learning on Windows malware detection. Moubarak & Feghali. (2022) making the comparison using the average detection time on detecting malware using different machine learning. In their project, the author using the detector ROC Curve for getting the TPR and FPR classifier performance graph. Pavithra & Josephin (2020) making the comparison malware classification using the various of machine learning. The author also using the various method for classification malware from different machine learning. The accuracy from each model determined the effectiveness of malware detection on the specific malware dataset. # METHODOLOGY **The main objective is to develop the malware detection model using the machine learning algorithms which are Random Forest, Neural Network, Decision Tree, K-NN and Naïve Bayes. This phase is the important phase for making a static analysis which is implementation and testing phase. Next, there are three phases in research which are training phase, testing phase and the analysis phase. First is the training phase includes collecting and inputting malware dataset (80%) as training input, extracting suitable features to represent the malware file, classifying the extracted feature based on categories of malware types and storing it as classifier to be used in the Testing phase. Second is the testing phase includes of collecting and inputting malware dataset (20%) as testing input, extracting features (same form of features such as in Training phase), compare the features with the stored classifier to decide the type of malware category the testing malware feature belong (Accept) or do not belong to any type of malware category (Reject). Third is an analysis phase. An analysis phase includes of the recording the results of Testing and Training Phase. Figure 1** **shows the flow chart of the method for making static analysis using the machine learning in this project.** ![](630f69ead1e1c_media/media/image1.png) **Figure 1**: Flow chart of the method for making static analysis using the machine learning in this project. **DESIGN AND DEVELOPMENT PROJECT** Machine learning techniques such as K-NN, Decision Tree, Neural Network, Random Forest, and SVM were used in this phase to design a detection model. The classifier or algorithms used are determined by the type of features, the size of the dataset, and the problem to be solved. After removing irrelevant features, these classifiers were used. Following that, these features will be trained and tested on each classifier to perform classification tasks. **Scripting of Machine Learning Algorithms** In this section, the scripting from each machine learning algorithms is different. The training model is based on the machine learning algorithms which need to be fit with the training data. Below are the figures that shows the scripting for each model. **K-NN** ![Graphical user interface, text, application, email Description automatically generated](630f69ead1e1c_media/media/image2.png) **Figure 2**: The scripting of the K-NN machine learning algorithm. **Decision Tree** ![Graphical user interface, text, application Description automatically generated](630f69ead1e1c_media/media/image3.png) **Figure 3**: The scripting of the Decision Tree machine learning algorithm. **Neural Network** ![Graphical user interface, text, application Description automatically generated](630f69ead1e1c_media/media/image4.png) **Figure 4**: The scripting of the Neural Network machine learning algorithm. **RandomForest** ![Graphical user interface, text, application, email Description automatically generated](630f69ead1e1c_media/media/image5.png) **Figure 5**: The scripting of the RandomForest machine learning algorithm. **Naïve Bayes** ![Graphical user interface, text, application Description automatically generated](630f69ead1e1c_media/media/image6.png) **Figure 6**: The scripting of the Naïve Bayes machine learning algorithm. **FINDINGS AND DISCUSSIONS** After the training and testing set has been done, the result will be produced by indicating the percentage detection accuracy in each detection model. By using the confusion matrix, the calculation on the getting percentage detection accuracy, False Positive Rate (FPR), True Positive Rate (TPR) and False Negative Rate (FNR) also been done. The four key performance metrics True Positive (TP), False Positive (FP), True Negative (TN), and False Negative (FN) will be computed to assess the outcomes. The percentage of samples that were accurately identified as malware will be shown by the True Positives Rates (TPR). False Positive Rates (FPR) will indicate the proportion of samples that were incorrectly classified as malware. False Negative Rate (FNR) is the ratio of false-negative and positive which is double incorrectly classified as malware. The formulas for the performance measurements are **TPR=TP/(TP+FN), FPR=FP/(FP+TN)** and **FNR = FN / P**. While overall accuracy is the percentage of all correctly predicted outcomes, it is calculated as **Accuracy=((TP+TN))/(TP+FP+TN+FN** ). After all these five machine learning algorithms results been collected, this part is to make an analysis result by comparing the result of the percentage detection accuracy on the same Windows malware dataset. The Random Forest has the highest percentage of detection accuracy which is 0.96% according to this table comparison. This indicates that, when compared to other machine learning algorithms, the Random Forest Machine Learning Algorithm offers the best high accuracy detection for differentiating between malware and benign software. The reason why the Decision Tree Machine Learning Algorithm has the best percentage detection accuracy on differentiating between malware and benign software because it has the highest TPR which is 0.94% that shows the highest accurately identified as malware and the lowest FPR and FNR which are 0.03 % and 0.06% respectively that shows the percentage on inaccurately identified as malware compared to the K-NN, Neural Network, Decision Tree and Naïve Bayes Machine Learning Algorithms. Figure 7 shows the table of the result for each supervised machine learning. > ![Graphical user interface, text, application Description automatically generated](630f69ead1e1c_media/media/image7.png) **Figure 7**: Table of Comparison Accuracy of Supervised Machine Learning **CONCLUSION AND RECOMMENDATION** Malware developed with advanced and complex by the day. By comparing five different classifiers on machine learning methods, the focus of this experiment is on analysing and measuring the detection accuracy of the Machine Learning classifier that used static analysis to extract the features based on PE information. We were able to train machine-learning algorithms to distinguish between malicious and benign files. According to the results, the Random Forest machine learning technique is the best classifier for classifying our data with 0.96% accuracy. According to the results of this experiment, using static analysis based on PE information and selecting the relevant features of the data can also provide the best detection accuracy and accurately represent malware. Another benefit of static analysis is the accuracy percentage detection still get higher even though the malware does not execute. **REFERENCES** > Irfan, Ariffin, Naz & Anuar, S. (2020). A Malware Detection Framework Based on Forensic and Unsupervised Machine Learning Methodologies. 194–200. Moubarak, Joanna, and Tony Feghali. Comparing Machine Learning Techniques for Malware Detection - Researchgate. https://www.researchgate.net/publication/340214601\_Comparing\_Machine\_Learning\_Techniques\_for\_Malware\_Detection. Pavithra & Josephin. “IOPscience.” IOP Conference Series: Materials Science and Engineering, IOP Publishing, 1 Dec. 2020, 899X/993/1/012099/meta. Samy, Ganthan Narayana, et al. “Analysis of Feature Categories for Malware Visualization.” *Journal of Telecommunication, Electronic and Computer Engineering (JTEC)*, . Selamat & Ali. (2019). Comparison of malware detection techniques using machine learning algorithm. Indonesian Journal of Electrical Zakaria, Abdollah, Mohd & Ariffin. (2017). The Rise of Ransomware. Proceedings of the 2017 International Conference on Software and E-Business - ICSEB 2017.