Toward Detecting Malware Based on Process-Aware Behaviors

Table 3

Test results comparison with state-of-the-art.

Approach	Arg	Pro	Accuracy (%)	Precision (%)	Recall (%)	F1-score (%)	Pro-time (ms/s)	Detect-time (ms/s)
Decision tree	No	No	76.32	90.28	58.99	71.36	70.25	0.34
Zhang et al. [6]	Yes	No	91.76	97.64	85.59	91.22	206.65	17.05
MalPro [35]	Yes	Yes	96.78	96.82	96.78	96.80	135.46	2.38
Our method	Yes	Yes	97.63	97.64	97.63	97.64	141.23	2.41

¹Note that Arg. is abbreviated to argument and Pro. to process feature. As for pro-time and detect-time denotes processing time and response time respectively, and ms/s denotes the time consumed by each sample. The data is bolded to indicate the best-performing result in terms of performance metrics. And “Our method” is bolded to distinguish other methods.