PDF Malware Detection Based on Fuzzy Unordered Rule Induction Algorithm (FURIA)

Round 1

Reviewer 1 Report

1.      What factor the MCC is influenced the performance of the proposed system?

2.      What methodology has been to rank the selected features?

3.      What is the necessity to fix the K value as 10? Why not greater than 10?

4.      References 6, 15, 26,27, 29 are not in proper format. Refer the guidelines.

5.      What contribution is made to formulate the proposed system with [29]?

6.      Equations are not in order.

7.      Check the line number 160, there are same two ranking for the features. Justify with your answer and how that can be derived?

8.      What is the methodology followed to generate the rules?

9.      What are the rules formulated for classification?

 

10.   The proposed system is not clear. 

Author Response

Please see attached.

Author Response File: Author Response.pdf

Reviewer 2 Report

Overall, the paper is well written and east to follow.

The paper lacks description indicating the innovation based on the original Fuzzy Unordered Rule Induction Algorithm (FURIA) algorithm.

The authors should explain more about the feature selection. 

 

Author Response

Please see attached.

Author Response File: Author Response.pdf

Reviewer 3 Report

In order to achieve PDF Malware Detection, this paper selects some features and uses a Fuzzy Unordered Rule Induction Algorithm to detect PDF malwares. In general, this paper is easy to follow. I would like to accept this paper if my following concerns are carefully addressed.

1. The authors need to emphasize their contributions/novelties in the revision. In the current version, the authors did not discuss their contributions in detail.

2. The authors conducted a large number of experiments and used a variety of evaluation indicators to evaluate the method of the paper. However, in the part of analysis of experimental results, the paper only explained the experimental results without in-depth analysis. It is hoped that the author can make a more detailed discussion from the reasons and error analysis of the results.

3. Could the authors report the running time of the proposed algorithm? In this way, we can justify whether this algorithm can be applied to large-scale dataset.

4. The authors should carefully proofread this paper and correct all the typos in the revision. In the current version, there are still some typos/grammar errors. Some errors are shown below：

       - The format of the first paragraph is different from the others;

       - ’The Ripper Algorithm’ should be ‘The RIPPER Algorithm’.

Author Response

Please see attached.

Author Response File: Author Response.pdf

Reviewer 4 Report

This paper proposed a model based on the FURIA to detect PDF malwares.  The experimental part of the article is relatively complete. But this paper needs to make the following modifications:

1.   There are some errors in the layout style, including the indentation of first paragraphs and references, the alignment of mathematical formulas, the primary objectives and main contributions of this study in section 1.2, the font of references. Please check carefully.

2.     The conclusion section needs to elaborate more by discussion the disadvantages of the developed model and discussion on the results obtain. The author should also include the future work section. The background part shouldn’t be here.

3.   In section 3, the multiplication sign is replaced with the letter x incorrectly in formula 4. Use \times instead of x.

4.   In section 3, “Fuzzy Unordered Rule Induction Algorithm (FURIA)” is meaningless bold. If it’s a title, please check the title format.

5.   The description during line 247 to 250 is redundant.

6.   Language needs to be strengthened. There are some grammatical errors in the article.

Author Response

Please see attached.

Author Response File: Author Response.pdf

Round 2

Reviewer 1 Report

The authors are requested to compute the confusion matrix to find out the FP and TP.

Author Response

Round 2:

 

The authors are requested to compute the confusion matrix to find out the FP and TP

 

ADDED to page: 8

 

All these values are achieved using confusion matrix. Confusion matrix values achieved via each model is presented in Table 2.

 

Table 2. Confusion Matrix values Achieved via each Employed Model

Models		no	yes
FURIA	no	8995	11
	yes	27	10953
NB	no	8807	199
	yes	97	10883
J48	no	8977	29
	yes	33	10947
HT	no	8943	63
	yes	67	10913
QDA	no	8942	64
	yes	82	10898

 

Author Response File: Author Response.pdf