Real-Time Malware Process Detection and Automated Process Killing

Table 6

Average resource consumption over 100 iterations for a batch size of 100 vs. F1-scores on validation and test set for classification and process killing across 14 models..

Model	n features	Avg. cpu ()	Avg. dram (W)	Avg. Duration ()	Val F1	Kill val F1	Test F1	Kill test F1
AdaBoost	26	127967.84	7981.51	6595.37	88.35	74.36	77.19	60.09
AdaBoost	37	125041.20	7142.93	6469.16	89.63	76.07	80.10	60.14
DT	26	3905.63	202.65	128.02	97.39	88.48	66.44	62.95
DT	37	2113.67	134.29	106.65	96.32	83.57	79.61	62.50
GBDT	26	8788.41	338.78	349.31	92.27	78.26	82.47	63.33
GBDT	37	11005.80	486.46	329.45	93.13	80.26	84.94	63.46
MLP	26	11044.88	645.14	461.04	82.84	70.18	41.62	57.65
MLP	37	12932.09	628.64	555.42	73.00	67.63	57.66	57.26
NB	26	6947.67	297.87	185.73	75.80	67.42	62.90	56.11
NB	37	5187.96	258.80	177.37	75.58	67.61	61.88	55.33
RF	26	238621.20	11052.84	8997.31	97.12	92.97	71.58	75.97
RF	37	236598.44	9967.63	8879.97	96.57	91.05	85.55	77.85
RNN	26	887664.31	48885.96	27869.30	97.44	90.70	74.91	73.08
RNN	37	312108.07	17120.90	10414.58	94.61	87.31	77.66	71.95
SVM	26	6630490.84	464082.07	282026.57	78.34	67.04	68.16	56.91
SVM	37	7792179.78	730786.06	429081.31	64.89	65.68	61.39	56.25