From: Detecting unknown malicious code by applying classification techniques on OpCode patterns
 |  | Top 1800 over all n-grams | Top 300 for each n-gram size | ||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|
Feature selection | Top features | 1 | 2 | 3 | 4 | 5 | 6 | 1 | 2 | 3 | 4 | 5 | 6 |
DF | 50 | 0.3 | 0.42 | 0.24 | 0.04 | 0 | 0 | 1 | 0 | 0 | 0 | 0 | 0 |
DF | 100 | 0.17 | 0.39 | 0.28 | 0.13 | 0.03 | 0 | 1 | 0 | 0 | 0 | 0 | 0 |
DF | 200 | 0.11 | 0.27 | 0.36 | 0.21 | 0.06 | 0.01 | 1 | 0 | 0 | 0 | 0 | 0 |
DF | 300 | 0.08 | 0.25 | 0.34 | 0.23 | 0.09 | 0.01 | 1 | 0 | 0 | 0 | 0 | 0 |
FS | 50 | 0.06 | 0.18 | 0.38 | 0.16 | 0.1 | 0.12 | 0.54 | 0.08 | 0.16 | 0.1 | 0.06 | 0.06 |
FS | 100 | 0.03 | 0.17 | 0.36 | 0.26 | 0.12 | 0.06 | 0.43 | 0.12 | 0.19 | 0.1 | 0.11 | 0.05 |
FS | 200 | 0.02 | 0.13 | 0.33 | 0.27 | 0.18 | 0.08 | 0.35 | 0.14 | 0.2 | 0.14 | 0.12 | 0.08 |
FS | 300 | 0.02 | 0.1 | 0.3 | 0.3 | 0.21 | 0.08 | 0.3 | 0.15 | 0.2 | 0.15 | 0.11 | 0.08 |
GR | 50 | 0 | 0.16 | 0.36 | 0.22 | 0.22 | 0.04 | 0.06 | 0.2 | 0.36 | 0.14 | 0.1 | 0.14 |
GR | 100 | 0 | 0.12 | 0.33 | 0.29 | 0.17 | 0.09 | 0.03 | 0.19 | 0.36 | 0.23 | 0.11 | 0.08 |
GR | 200 | 0.01 | 0.13 | 0.31 | 0.32 | 0.16 | 0.09 | 0.04 | 0.15 | 0.31 | 0.22 | 0.17 | 0.12 |
GR | 300 | 0.01 | 0.17 | 0.3 | 0.28 | 0.15 | 0.08 | 0.04 | 0.14 | 0.28 | 0.24 | 0.18 | 0.13 |