Memory Forensics-Based Malware Detection Using Computer Vision and Machine Learning

Round 1

Reviewer 1 Report

1-    The authors  have been used machine leaning approaches, where is contribution  in this research?  Actual, a lot of the research has been  used machine leaning for  detecting intrusion

2-    Structure of Introduction is not clear (an introduction can, for example, follow the structure: what is the problem, why this problem is important, what this paper provides to deal with the problem, what are the results. Furthermore,  what is Memory forensics.

3-     In line 150 what is different between Disk Operating System (DOS)   and DoS?

4-    Line 366 Proposed technique, this  a generic model,  the word of proposed something new. Authors should  shows  their developed  algorithms.

5-    Authors should  add the  algorithm code  on  any repository like GitHub.

6-    Line 388  in table, author  explain  all types of attacks

7-     Where is  confusion metrics  of  decision tree  and XGBoost  algorithm ?

8-     I asked author used deep leaning for comparing with machine leaning results   

Author Response

Please see the attachment

Author Response File: Author Response.pdf

Reviewer 2 Report

In Figure 3, what are X1, X2...? Some more explanation could be added in libe 201. 

Highlight the differences between the proposed methodology and reference #28 after line 352.

What is CLAHE. Did you mention its full form before using the abbreviation in line 360?

There is a significant amount of "Previous Work" in section 3. Please move them to section 2 and reorganize the section. 

How were the images being converted to a machine readable format for SVM, or Random Forest. Add a flowchart like Figure 4 to explain the process. 

Convert Figure 12 and Figure 16 into a table format for better interpretation. 

Do the confusion matrices resemble training or validation data?

Any preliminary techniques to address data imbalance used? Explain. 

Were other image augmentation techniques explored besides the two mentioned in the paper? Explain.

Author Response

Please see the attachment

Author Response File: Author Response.pdf