MalDroid: Secure DL‐enabled intelligent malware detection framework

IET CommunicationsEarly View ORIGINAL RESEARCH PAPEROpen Access MalDroid: Secure DL-enabled intelligent malware detection framework Ikram Ul Haq, Corresponding Author Ikram Ul Haq Ikram.haq@gmail.com orcid.org/0000-0002-1100-7932 Software Engineering Department, Bahria University, Islamabad, Pakistan Correspondence Ikram Ul Haq, Software Engineering Department, Bahria University, Islamabad, Pakistan. Email: Ikram.haq@gmail.comSearch for more papers by this authorTamim Ahmed Khan, Tamim Ahmed Khan orcid.org/0000-0002-8209-6100 Software Engineering Department, Bahria University, Islamabad, PakistanSearch for more papers by this authorAdnan Akhunzada, Adnan Akhunzada orcid.org/0000-0001-8370-9290 Faculty of Computing and Informatics, University Malaysia Sabah, Kota Kinabalu, MalaysiaSearch for more papers by this authorXuan Liu, Xuan Liu orcid.org/0000-0002-7966-4488 College of Information Engineering (College of Artificial Intelligence), Yangzhou University, Yangzhou, ChinaSearch for more papers by this author Ikram Ul Haq, Corresponding Author Ikram Ul Haq Ikram.haq@gmail.com orcid.org/0000-0002-1100-7932 Software Engineering Department, Bahria University, Islamabad, Pakistan Correspondence Ikram Ul Haq, Software Engineering Department, Bahria University, Islamabad, Pakistan. Email: Ikram.haq@gmail.comSearch for more papers by this authorTamim Ahmed Khan, Tamim Ahmed Khan orcid.org/0000-0002-8209-6100 Software Engineering Department, Bahria University, Islamabad, PakistanSearch for more papers by this authorAdnan Akhunzada, Adnan Akhunzada orcid.org/0000-0001-8370-9290 Faculty of Computing and Informatics, University Malaysia Sabah, Kota Kinabalu, MalaysiaSearch for more papers by this authorXuan Liu, Xuan Liu orcid.org/0000-0002-7966-4488 College of Information Engineering (College of Artificial Intelligence), Yangzhou University, Yangzhou, ChinaSearch for more papers by this author First published: 02 August 2021 https://doi.org/10.1049/cmu2.12265AboutSectionsPDF ToolsRequest permissionExport citationAdd to favoritesTrack citation ShareShare Give accessShare full text accessShare full-text accessPlease review our Terms and Conditions of Use and check box below to share full-text version of article.I have read and accept the Wiley Online Library Terms and Conditions of UseShareable LinkUse the link below to share a full-text version of this article with your friends and colleagues. Learn more.Copy URL Share a linkShare onFacebookTwitterLinked InRedditWechat Abstract Nowadays, smartphones are provided with an abundance of capabilities. During the last decade, the availability of smartphone users and online mobile payment services and applications have substantially grown. Besides, the Android infotainment market is exponentially growing and thus potentially becoming a primary target for cyber adversaries and attackers. Likewise, varied Android vulnerability exploitation and targeted pervasive malware sophisticated attacks are also becoming a hot spot for both industry and academia. The authors present a secure by design efficient and intelligent Android detection framework against prevalent, sophisticated and persistent malware threats and attacks. A novel and highly proficient Cuda-enabled multi-class malware threat detection and identification Deep Learning (DL)-driven mechanism that leverages ConvLSTM2D and CNN has been proposed. The devised approach has been extensively evaluated on publicly available state-of-the-art datasets of Android applications (i.e. Android Malware Dataset (AMD), Androzoo). Standard and extended assessment metrics have been employed to thoroughly evaluate the proposed technique. Moreover, the performance of the proposed algorithm has been verified both with the constructed hybrid DL-driven algorithms and current benchmarks. Additionally, the proposed scheme is cross validated to explicitly show unbiased results. 1 INTRODUCTION In the current era, smartphones and Internet of Things (IoT) are ubiquitous being used as the prime medium of communication and infotainment. Despite largely serving humanity, these smart devices play a pivotal role in providing consistent digital connectivity, ease of communication, and improved quality of life. Android platform is majorly contributing to create vast digital landscape and convenient access to information and communication. So far, Android dominates the smart phones market and thus serving as a backbone and only open source operating system (OS) for telecommunications. Besides, it helps to collect sensitive data and information such as contact details, accounts, location, healthcare tracking, social interests, and varied other services for better decision making and analysis. Android is the current backbone of smartphones industry. However, the success of Android market has become an attractive opportunity and prime target for cyber adversaries and attacker [1]. Android is an open-source Operating System (OS) and has acquired the highest 85% market share of smartphone industry. Android OS allows users to download and execute available applications that are owned by different third-party clients and organizations [2]. The astonishing growth and popularity of Android is not limited to smartphones only but also serves smart TV's, smart homes, intelligent watches, and car navigation systems [3]. Android is also recognized as a promising platform for the growth and development of intelligent IoT-based infrastructure [4, 5]. Being an open-source OS, it is an alluring target for the attackers to disseminate and craft malicious software's [6, 7]. These malicious software's precisely known as malware are intentionally developed to perform diverse attacks [8, 9]. Consequently, having diverse variants and complex nature, detecting these notorious malicious applications is quite challenging [10, 11]. Malware is a set of deliberately crafted malicious software to extensively damage significant data and devices through information theft, privilege escalation, remote unauthorized access, and so on [12]. Besides, this prevalent and sophisticated malware is extremely immaculate that can throw the entire Android OS into chaos [13]. Besides, the growth of malware increased exponentially because of Android overwhelming effect on both business and end-users. Malware can simply gain root access and thus cannot be traced back easily [14]. Moreover, cyber adversaries manage to gain unparalleled levels of disruption to compromise Android systems using varied techniques, strategies, and persistent zero-day attacks [15]. Considering the potentially increased threats and attacks targeting Android environment; the research community still lacks identifying emerging potent behavior, pattern, and trends of diverse malware families. Besides, identifying proficiently zero-day Android malware attacks is still in its infancy. Finally, researchers and analysts are currently trying hard to develop systems that can efficiently identify zero-day malware. Deep Learning (DL) has emerged as a promising face of the Artificial Intelligence (AI) community, inspired by the number of effective approaches in natural language processing, image classification, speech recognition, security, privacy etc. Recently, the Android-based research community is taking a keen interest in exploring DL-based mechanisms for the identification of sophisticated, persistent, and lethal malware [16]. In this research work, a proficient and scalable Android malware detection scheme has been proposed that employs ConvLSTM2D and CNN. The framework of our devised malware detection module in Android OS is depicted in Figure 1. FIGURE 1Open in figure viewerPowerPoint The overview of proposed android malware detection module in android architecture 1.1 Contributions The following are the major contributions of the proposed study: The authors propose an adaptive, intelligent, and scalable secure by design DL-based detection framework leveraging ConvLSTM2D and CNN to effectively ascertain multi-class attacks and threats in the Android environment. The state-of-art publicly accessible datasets named Android Malware Dataset(AMD) and Androzoo have been used to thoroughly evaluate multi-class attacks. To completely evaluate the proposed scheme, standard and extended performance assessment metrics including accuracy, precision, recall, F1-score, TNR, TPR, FPR, FNR, FDR, MCC, FOR have been utilized. Moreover, 10-fold cross-validation has been carried out to utterly show unbiased results. Likewise, our devised mechanism has been verified extensively with our constructed hybrid DL architectures and current benchmarks. 1.2 Organization The rest of this paper is structured as follows. Section 2 presents the relevant literature related to different malware identification scheme. While, Section 3 defines the methodology of presented system including dataset, preprocessing techniques, and proposed system. Experimental setup, performance evaluation metrics, and discussion on achieved results are defined in Section 4. Finally, we conclude the paper in Section 5. 2 RELATED WORK Extant research efforts have mainly using Android permission to detect prevalent malware [12, 17]. Zhu et al. in [18] presented a stacking ensemble known as SEDMDroid for the identification of sophisticated Android malware. The proposed framework employed bootstrap and Principal Component Analysis (PCA) to ensure the diversity for the generation of random feature subspace. Multi-Layer perception (MLP) and Support Vector Machine (SVM) are trained to learn supplementary information that yield the final prediction. The experiment is performed on official benign Android applications and malicious apps are collected from the virus share repository. The SEDMDroid achieved 94.92% detection accuracy. Iram et al. [19] proposed a dynamic deep learning-based architecture to identify Android malware leveraging Gated Recurrent Unit (GRU). Experimentation has been carried out on two diverse datasets known as Androzoo and Android Malware Dataset. The proposed scheme achieved 98.99% detection accuracy. Millar et al. in [20] implemented DAN for identification of malicious Android applications. While practical experimentation is performed on the Drebin dataset and achieved 97% average detection accuracy. Amin et al. in [21] presented a VM based open-source mobile anti-malware system. The detection system worked on opcodes extracted from application byte codes. A byte code dataset is augmented and BiLSTM is used to detect the static behavior achieving an accuracy of 99%. The authors in [22] proposed an end to end malware identification scheme based on deep learning for Android IoT devices. The model takes an input of re-sample the byte codes of the classes of around 16k samples of windows executable files. While the proposed model achieved detection accuracy of 95.8% . Alzaylaee et al. in [23], implemented an Android malware detection scheme using Deep Neural Network using API calls. The experimentation of the scheme is performed on APK's gathered from Intel-Security. The achieved detection accuracy is 95.2%. The Xiao et al. introduced a malware identification mechanism utilizing systems calls while using LSTM in [24]. The experimentation is performed on Drebin dataset with identification accuracy 93.7%. In [25], Iram et al. proposed an effective DL-based ransomware detection scheme through using Long Short-Term Memory (LSTM). The feature selection has been performed using simple majority voting on CICAndMal2017 dataset. The scheme achieved 97.08% detection accuracy. In [26] the permission induced risks in android applications are investigated using Gated Recurrent Unit and Convolutional Neural Network. The experimentation of the system is performed on the VirusTotal dataset and achieved a detection rate of 97.7%. In [27], to classify malicious Android apps, a Deep Neural Network (DNN) has been implemented. The Android APKs dataset has been used for evaluation and achieved 95% detection accuracy. In [28], an AI-based android malware characterization framework is developed leveraging LSTM. The dataset consists of 1738 instances of android applications which achieved 93.9–97.5% accuracy for dynamic and static analysis. Karbab et al. in [29] developed an AI-based intrusion detection system called MalDozer for the identification of malware. MalDozer is provided the sequences of API calls in a raw form as input. The system has been comprehensively checked on various datasets. The system has proved its efficacy and viability in pattern detection. Nonetheless, [30] uses Deep Neural Network (DNN) for static and dynamic analysis to design a DDefender strategy for malware detection. For experimentation dataset was comprised of 4208 instances and reached 95% identification accuracy. The authors in [31] came up with a detection framework to investigate the android based API calls generated by an application. A CNN classification sequence is arranged, directing convolution assignments along the sequence. The system learns progressive shapes for every zone as the convolution window slides down. The system used a dataset comprising of 1016 APK instances and acquired detection accuracy of 99.4%. Karbab et al. in [32] developed an android based malware detection system Cypider, the proposed system is a community-based malware detection module, as the malware families share some common characteristics hence the suspicious features are extracted and compared. It detects about 50% of malware in its single iteration and achieved an average accuracy of 87%. The literature review defined in Table 1 is very clear that DL-models are yet in their beginning towards an assessment of cyber attacks in Android OS. The majority part of the current work is based on binary classification [33-35]. Furthermore, the proposed hybrid model of ConvLSTM2D and CNN mechanism can be utilized to widely assess DL-models for the identification of Android malware. TABLE 1. The tabular comparison of existing literature for android malware detection Ref Year Dataset Model Contribution Limitation [18] 2020 Virus share, Android APK's Ensemble (MLP & SVM) Presented a stacking ensemble of MLP and SVM, called SEDMDroid for identification of sophisticated malware and achieved accuracy of 94.94%. The achieved detection accuracy is not good. [19] 2020 AMD, Androzoo GRU Presented a dynamic deep learning based scheme employing GRU and achieved accuracy of 98.99%. Testing time for proposed GRU is high for real time detection. [20] 2020 Drebin DAN Proposed android malware detection framework using DAN for classification of applications and achieved 97% accuracy. Detection accuracy is not very promising. [21] 2020 byte codes of Android Applications BiLSTM Presented a VM based open source mobile anti-malware through BiLSTM and achieved 99% detection accuracy. Number of instances are limited. [22] 2020 Byte codes of Android Application DNN Presented a DNN-based malware identification model on windows executable files for Android based IoT devices. The detection accuracy is not satisfactory in real time deployment. [23] 2019 Intel Security (McAfee-Labs). DNN Implemented a DL-based system to identify malware in Android with detection accuracy of 95.2% . Investigate diverse DL-based classifiers to improve overall efficiency of system. [24] 2019 Drebin LSTM Proposed a malware identification scheme leveraging LSTM and achieved detection accuracy as low as 93.7%. For real world deployment, other DL-based classifiers need to be investigated to improve detection accuracy. [25] 2019 CICAndMal2017 LSTM Presented a scheme for Android Ransomware identification and achieved 97.08% accuracy. Other deep learning classifiers needs to be investigated for improved accuracy. [26] 2019 VirusTotal GRU, CNN A deep learning based framework employing GRU, CNN has been implemented and achieved 97.7% detection accuracy. Other deep learning classifiers needs to be investigated for improved accuracy. [27] 2019 APK files DNN Presented DNN-based classification scheme for Android and obtained 95% detection accuracy. Very low detection accuracy. [28] 2018 Feature extraction through real time execution of Android application LSTM Implemented a malware identification scheme employing LSTM achieved 97.5%. The time of execution for Applications in emulator is short. [29] 2018 Drebin, Genome, Virusshare, Contagio, minidump ANN Proposed a malware detection scheme using ANN and acquired 90% detection accuracy. Limited family attribution. [30] 2018 Android APK DNN Utilized deep neural network (DNN) for android mawlare detection and reached 95% accuracy. Accuracy is not sufficient for commercial use. [31] 2017 Android Apk files CNN A Android malware detection scheme has been proposed using CNN and achieved 99.4% detection accuracy. Limited feature set. [32] 2016 Android Apk files DNN Proposed community-based malware identification scheme and obtained 87% detection accuracy. The feature set is very limited. 3 METHODOLOGY For the identification of sophisticated and prevalent Android malware. Figure 2 represents simplified overview of our devised framework of DL-based hybrid architecture (i.e. ConvLSTM2D and CNN). During the data acquisition phase, dataset is created that incorporates code, classes, and extraction of manifest file from Apk (Android package kit). Furthermore, manifest file is used to extract a feature vector. However, important feature selection, data normalization, transformation and label encoding have been performed in the data preprocessing phase. While in the model engineering phase, a DL-enabled hybrid of ConvLSTM2D and CNN is utilized for the recognition of truly evolving malware in Android OS. Lastly, the accomplished results have thoroughly been evaluated using standard and extended evaluation. FIGURE 2Open in figure viewerPowerPoint The basic architectural description for the proposed hybrid android malware detection framework 3.1 Android application overview In this section, the Android app structure has been briefly defined to get a better understanding of the feature extraction process. A basic Android Application Package (APK) from the App store contains Dalvik bytecode file, resources (i.e. templates, menu, attributes etc.), classes with executable code, and the AndroidManifest.xml file. The Android Manifest file is the global configuration file for an Android application. The components of an application are identified like services, activities, content providers, the broadcast receiver, and also implementation classes. The Android manifest file also includes access permissions for API and communication with other applications. The intent filters are also declared in Manifest file. Consequently, it declares the minimal version of the API that an application needs. 3.2 Data acquisition The Android security mechanisms primarily depend on its security authorization. Besides, the permission-based analysis and detection mechanisms are the reliable and fastest ones. However, inspired by the success of existing feature extraction techniques, our proposed architecture also extracted features at different levels from an APK file. To achieve an efficient and computational cost-effective approach for malware analysis, the unzipping of and Android APK has been performed using Java code. For the extraction of features from the Android manifest file, a customized python code has been executed to extract feature values for permissions, API call, and filtered intents. 3.3 Dataset For efficient Android malware identification, the selection of an appropriate dataset plays a momentous role in the evaluation of results. For experimentation, dataset containing 38842 APK's (30831 benign APK's from Androzoo [36] and 8011 malicious APK's from Android Malware Dataset (AMD) [37] have been utilized. AMD dataset overall contains ten different malware classes known as Trojan, Trojan-Dropper, Trojan-clicker, Trojan-Spy, Trojan-Banker, Trojan-SMS, Backdoor, Adware, Hacker Tool, Ransomware). Six diverse Trojan classes are combined into a single Trojan class label to create a balanced dataset. Hence, the whole distribution of the dataset consists of three different classes namely, Benign, Backdoor and Trojan. The dataset distribution for three classes can be visualized in Table 2. TABLE 2. Dataset distribution table for proposed malware identification scheme Class No. of samples Target label Benign 29903 0 Backdoor 1022 1 Trojan 6863 2 3.4 Data preprocessing Dataset preprocessing steps have been applied on raw datasets for transformation of data to achieve effective performance. Moreover, preprocessing of the dataset makes it less complex in terms of time and storage. Android Apk files of Androzoo and AMD are combined to produce dataset for the classification of applications. All the necessary characteristics for a dataset have been fulfilled (i.e. labeled dataset, malware diversity and heterogeneity, complete manifest file features). Using python code, almost 19,000 features are gathered but 350 important and frequently appeared features are selected for malware identification. It is necessary to achieve the scaled version of all the feature values to increase the efficiency of the malware detection system. Normalization of the dataset has been done using the python standard scalar function. The one hot encoding has been applied on target labels for learning of DL-algorithms. 3.5 Model engineering For the identification of evolving lethal malware, a hybrid of ConvLSTM2D and CNN has been employed. A proficient, adaptable and scalable Android malware identification technique has been executed which can recognize Trojan and Backdoor effectively. The complete architecture of devised hybrid framework including Layers, number of Neurons, Loss Function, Activation Functions, Optimizer, Epochs, Batch Size and Learning Rate are placed in Table 3. Furthermore, detailed working of proposed Hybrid (ConvLSTM2D + CNN) is described in Algorithm 1. TABLE 3. Description of proposed hybrid of ConvLSTM2D and CNN for malware detection system ConvLSTM2D + LSTM Conv2D + Conv2D Conv2D + LSTM DNN + DNN Algorithms Layer Neurons Layer Neurons Layer Neurons Layer Neurons Conv-LSTM2D 150 Conv2D 400 Conv2D 200 CNN 350 Conv-LSTM2D 75 Conv2D 100 Conv2D 100 DNN 100 Conv-LSTM2D 50 Conv2D 50 Conv2D 50 DNN 50 Flatten() – Flatten() – Flatten() – Flatten() – LSTM 150 Conv2D 400 LSTM 200 DNN 350 LSTM 75 Conv2D 100 LSTM 100 DNN 100 LSTM 50 Conv2D 50 LSTM 50 DNN 50 Flatten() – Flatten() – Flatten() – Flatten() – Dense 30 Dense 40 Dense 30 Dense 30 Dense 15 Dense 15 Dense 15 Dense 15 Dense 3 Dense 3 Dense 3 Dense 3 Activation function Relu, Softmax Loss function categorical crossentropy Optimizer Adam Epochs 50 Batch-size 16 Learning rate 0.01 ALGORITHM 1. Training of Hybrid (ConvLSTM2D + CNN) Require: Dataset-Training T, Dataset-Testing t, ConvLSTM2D-layers CL, Epochs E, Batch-Size B, Weights W Ensure: Training, Testing & Saving Results 1: function ConvLSTM2D(T): 2: Normalize T (0∼1) 3: Reshape T 4: Initialize W for CL & D 5: Hybrid(ConvLSTM2D + CNN) = ⊕(CL, D) 6: for E p o c h ← 1 to E do 7: for S a m p l e ← 1 …. T do 8: Train w.r.t B from T 9: Calculate Loss w.r.t B 10: if WrongPrediction then 11: Update W 12: end if 13: end for 14: end for 15: Result = Predict on t 16: Save Result 17: end function 3.6 Algorithms The basic engineering of utilized varied DL-algorithms ConvLSTM2D, Convolutional Neural Network (CNN), Long Short-Term Memory (LSTM), and Deep Neural Network (DNN)) is explained. 3.6.1 ConvLSTM2D The ConvLSTM2D is a recurrent layer similar to LSTM. However, the internal matrix duplication's are traded with convolution operation. The data that moves through the ConvLSTM cells keep the 3D tensor shape for input rather than being only a 1D feature vector. A Convolutional-LSTM model is an alternative way of a Convolutional-CNN, in which data has been passed as in 3D shape and outcome is achieved as a set of flattened 1D array. when the same process works in iterations so after some time a bunch of features are retrieved as a feature vector. 3.6.2 Long short-term memory Long Short-Term Memory a variation of RNN [38], is an algorithm used to learn and maintain long sequences of data. To flow error signal for learning long features, the LSTM classifier uses an unprecedented module called constant error carousel (CEC). To handle backpropagation error in LSTM, the gating mechanism has been used. The inside calculations and decision of CEC is chosen by the "gate" state as indicated by current data and past flow to control the data flow and memory. One LSTM cell is included with two states and three gates named hidden state, cell state, input gate, forget gate, output gate. Given the input sequence x = { x 1 + x 2 , … . , x t } where input gate, forget gate, and output gate in LSTM structure are documented individually as i t , f t and o t and the weights attached to them are W i , W f , W o , b i , b f and b o . The LSTM cell updates two states at each time step, cell state c t and hidden state h t . While for sigmoid function σ symbol is used. In equation 1, the decision of information like how much information is necessary to keep is decided by f t in a cell. x t is the current input vector and h t − 1 is obtained output value from previous layer. And b f is forget gate bias and W f is referred as weight matrix. f t = σ ( W f ∗ [ h t − 1 , x t ] + b f ) . (1)The input gate i t decides which information needs to be kept and update cell state accordingly. i t = σ ( W i ∗ [ h t − 1 , x t ] + b i ) . (2)For generation of new candidate values c t , Tanh is used which is basically hyperbolic tangent function. c t = tanh ( W c . [ h t − 1 , x t ] + b c ) . (3)Through multiplication of f t and old achieved value, the current candidate value is decided. Further the values are added in the equation like i t * c t . c t = f t ∗ c t − 1 + i t ∗ c t . (4)Lastly, the final output is calculated as o t . o t = σ ( W o ∗ [ h t − 1 , x t ] + b o ) . (5) h t = o t ∗ tanh ( c t ) . (6)The LSTM cell considers data as input to the LSTM input layer and hidden layers are associated with it. The neurons in output layer depend on the number of classes that are being classified. 3.6.3 Convolutional neural network For accomplishing exceptional outcomes in image processing, natural language processing, and speech recognition, Convolutional Neural Network (CNN) is currently being employed in the cybersecurity field [39, 40]. CNN can gain proficiency with the significant highlights consequently contrasted with ordinary element determination calculations. CNN is comprised of sequence of processing unit which is interconnected and planned to change the arrangement of input to the arrangement of required output. Input, hidden layers, filter size, stride, and output are fundamental parts of a CNN classifier [41]. CNN perform different operations on the data, which incorporate convolution, pooling, flattening, and padding. 3.6.4 Deep neural network DNN [42] is perceived as a standard Artificial Neural Network with various interconnected layers among input and output layers [41]. The DNN finds the right numerical equation to change over the contribution to the output classification. Each single layer of DNN comprises neurons which performs computation. The node gets input, performs calculation while using weights, applies activation function, and afterward passes the information to the following node until to an end node for classification. 4 EXPERIMENTAL SETUP, RESULTS AND DISCUSSION This part of the paper defines the arrangements for experimentation, performance metrics, and achieved results alongside discussion. 4.1 Experimental setup The training of the proposed hybrid of ConvLSTM2D and CNN is performed using a python library known as Keras with python version 3.8. The libraries used to accomplish the desired results are Numpy, Tensorflow, Scikitlearn, Pandas. The experimentation is performed by using a single PC server having a Core-i7 (3.4 GHz) processor, Model 9700, GPU (Graphical processing Unit) NVIDIA GTX-1660. The operating system used to perform the experiments is Windows 10-64 Bit and RAM 16 GB-2400 MHz. The specifications of underlying system are defined in Table 4. TABLE 4. Software and hardware requirements for hybrid DL-based classifier CPU Processor Core-i7(3.4Ghz) Model 9700 Generation 9th GPU NVIDIA GTX-1660 OS Windows 10 - 64 Bit RAM 16GB - 2400 MHz Language Python3.8 Software Scikitlearn, Numpy, Pandas, Tensorflow 4.2 Performance evaluation Standard evaluation metrics are employed to measure and analyze the efficiency and accuracy of proposed anomaly detection system [43]. These performance metrics for evaluation that have been implemented in our work are Accuracy, Recall Precision, ROC, F1-Score, True Negative Rate (TNR), False Discovery Rate (FDR), False Negative Rate (FNR), False Positive Rate (FPR), False Omission Rate (FOR), Matthews Correlation Coefficient (MCC) and testing and training time. The confusion matrix is used to represent the actual values of some elements such as True Positive (TP), True Negative (TN), False Positive (FP), and False Negative (FN). The graphical representation for doing the difference and contrast