## 2 Materials and Methods
### Applied Methods
#### 2.4.4 The Hybrid Model  
The implementation of the GRU-GAN (Gated Recurrent Unit-Generative Adversarial Network) model is depicted in Figure 2. This architecture combines the sequential processing strengths of GRUs with the adversarial training features of GANs, providing a  
\begin{table}
\begin{tabular}{c c c} \hline \hline
**Algorithms** & **Parameters Used** & **Values** \\ \hline \multirow{8}{*}{BiLSTM and BiGRU} & Input\_dim & Vocab\_size \\  & Output\_dim & 128 \\  & Input\_length & Max\_length \\  & Learning rate & 0.001 \\  & Dense Unit & 64 \\  & Activation Input & relu \\  & Activation Output & sigmoid \\  & Optimizer & Adam \\ \hline \multirow{8}{*}{GRU-GAN} & Epoch & 50 \\  & Learning rate & 0.001 \\ \cline{1-1}  & Dense Layers unit & 258, 128, 64 \\ \cline{1-1}  & Activation Layer Input & Relu \\ \cline{1-1}  & Activation layer output & Sigmoid \\ \cline{1-1}  & Kernel\_regularizer & 11, 12 \\ \cline{1-1}  & Batch Normalization Layer & Sequence\_length \\ \cline{1-1}  & Dropout Layer & 0.5 \\ \cline{1-1}  & Manual Seed & 2 \\ \hline \hline \end{tabular}
\end{table}
Table 2: A summary of the different parameter settings for the models.  
unique solution to the complexities of malware detection. The process begins with data preparation, utilizing three distinct datasets: training data (dataset 1 and dataset 2) and test data (dataset 3). The preprocessing stage extracts API call sequences from these executable files, forming the basis for model training and evaluation.  
The GRU-GAN architecture consists of two primary components: a generator with four GRU layers (258, 128, and 64 hidden units) that produces fake API call sequences and a discriminator with two GRU layers (64 and 100 hidden units) that distinguishes between real and fake sequences. The training process involves meticulous hyperparameter tuning to optimize learning rates, GRU unit numbers, and noise dimensions, followed by adversarial training where the generator and discriminator engage in alternating cycles of improvement. This phase leverages the training datasets to refine the model's ability to generate realistic malware-like sequences and accurately differentiate between benign and malicious patterns.  
Post-training, the model's effectiveness was rigorously evaluated using the test data (dataset 3), measuring key metrics such as discriminator accuracy, precision, recall, F1 score, AUC-ROC, false-positive rate, and false-negative rate. For real-world applications, new executable files undergo API call sequence extraction before being classified by the  
Figure 2: The architecture of the proposed GRU–GAN model.  
trained discriminator. The performance of the model is continuously monitored, with ongoing fine-tuning based on accuracy metrics and emerging malware samples, ensuring its adaptability to evolving threats. This comprehensive approach, combining the sequential processing capabilities of GRUs with the adversarial learning paradigm of GANs, provides an enhanced solution for detecting increasingly complex malware behaviors. For a clearer understanding of the implementation process, we present Algorithm 1 of the proposed hybrid model.  
```
Input: S, L, E, M Output: P, R
1. trainData, testData = splitData(S, L, 0.8)
2. trainSeq, testSeq = padSequences(trainData, M), padSequences(testData, M)
3. V = uniqueAPICallsCount(S)
4. Define and train models: biLSTM, biGRU, gruGAN
5. G = Generator and D = Discriminator
6. Train biLSTM, biGRU on trainSeq
7. for epoch = 1 to 50 do
8. fakeSamples = G.generate(batchSize)
9. D.train(realSamples, fakeSamples)
10. G.train(through = gruGAN)
11. endfor
12. Ensemble prediction: Pred1,Pred2,Pred3=biLSTM_predict(testSeq), biGRU.predict(testSeq), gruGAN.predict(testSeq)
14. P = average(Pred1, Pred2, Pred3)
15. Evaluate Performance:
16. R = calculateMetrics(P, testLabels)
17. return P, R
18. end
```  
**Algorithm 1** Malware detection models.