Real-Time Malware Process Detection and Automated Process Killing

Table 12

Random Forest and Decision Tree each with a minimum requirement of two alerts (“malicious classifications”) to kill a process. F1, TNR, and TPR reported on validation and test set.

Model	n features	Val			Test
		F1	Tnr	tpr	F1	tnr	tpr
RF (alerts: 2)	37	91.30	94.96	88.24	81.50	81.53	87.97
DT (rolling mean: 2)	26	93.16	94.96	91.60	73.82	66.19	88.40