# Lightweight and Robust Malware Detection Using Dictionaries of API Calls
## 1 Introduction
Despite the ingenious ideas employed by attackers, malware execution and malicious activities still depend on the presence of a host's operating system [16]. Therefore, malware seeks to exploit the Windows API call service as a means to carry out malicious actions. By taking advantage of the resources and functions provided by the operating system, malware can manipulate and interact with critical system components, enabling unauthorized operations and potentially compromising the security of the target system. As a result of this interaction, harmful behaviors are exhibited that can be leveraged to detect the presence of malware. As stated in [17], the use of the system API call cannot be hidden by malware, allowing for effective identification and detection of malicious activity. Despite the effective benefits of employing machine learning in detecting malware, particularly zero-day malware, by using data extracted from the execution phase, such as API calls, the process of gathering precise API call features to reliably differentiate between malware and goodware continues to present a formidable challenge. The accuracy provided by API call features has been emphasized in most research in this area [18], rather than prioritizing the speed of solutions. Additionally, earlier studies have focused on complex feature sets or the utilization of neural networks, while simpler techniques remain relatively unexplored. Equally important, in a dynamic world, nothing remains static especially when talking about malware as the characteristics evolved over time. This effect changes the distribution of data used to train the detection models. Such a significant effect makes the detection models less effective in detecting zero-day malware. Cybersecurity tools can be employed at different layers of the enterprise IT infrastructure. However, by implementing malware detection at the edge, it becomes possible to implement malware protection technologies directly at the point where data is generated. While this method offers the advantage of real-time operation, its effectiveness is restricted by resource availability, making execution time a critical factor to consider. To develop edge systems that accurately identify potentially harmful situations within the constraints of execution time and complexity, this study aims to investigate the following research questions:  
* What is a straightforward representation of API call features that can yield a highly effective malware detection model with fast execution? * How does model drift impact the accuracy of such a model? The main contributions of this research can be summarized in the following way:  
* An analysis of API call behavior to uncover the reuse rate trends in both malware and goodware. * Utilization of distinct datasets for training and testing purposes. * Introduction of a straightforward feature representation method using API call dictionaries. * A recommendation that the statistical classifier (STC) serves as a simple yet robust classifier that can effectively combat model drift. Furthermore, it offers a solution with less complexity, rendering it highly suitable for edge environments. The subsequent sections of this paper are structured as follows: Section 2 discusses the malware analysis methods; Section 3 presents the related works; the used datasets are elaborated in Section 4; API call dictionaries are described in Section 5; Section 6 explains the STC model; the experimental results are presented in Section 7; Section 8 provides the comparison and limitation of this work; and finally, conclusions and future works are outlined in Section 9.