## 4 Results and Discussion
### API Categorisation
#### 4.3.1 Overall API Categorisation  
Table 4 provides details on the breakdown of 266 API calls in the context of malware analysis, categorising them into 23 distinct categories. This detailed categorising offers valuable insights into how various API categories are leveraged by malware. It not only allows the derivation of significant conclusions but also enhances the understanding of malware behaviour. The significance of Windows APIs in detecting malicious activities is evident from their extensive use by malware, as highlighted in our findings. Approximately 22% of the analysed malware samples interact with Windows operating systems through these APIs, often for system manipulation and exploiting vulnerabilities. This high usage indicates that monitoring Windows API calls can be a critical strategy in identifying and mitigating malware threats. The prevalence of file system (12%) and registry manipulation (8.2%) APIs highlights the malware's tendency to modify files and system registries. This behaviour is typically aimed at establishing persistence and concealing the malware's presence, making these APIs crucial targets for monitoring. The security and identity category (10%) reveals that a significant portion of malware focuses on bypassing security measures. This finding suggests the need for enhanced security protocols and vigilant monitoring of these APIs to prevent unauthorised access and identity theft. The socket category (8%) highlights the malware's focus on establishing network connections for communication or data transfer. \begin{table}
\begin{tabular}{c c c} \hline \hline
**Category** & **Percentage (\%)** & **Example APIs** \\ \hline Windows & 22 & FindWindow \\ File system & 12 & NtReadFile \\ Security and identity & 10 & CryptCreateHash \\ Registry & 8.2 & RegCloseKey \\ Socket & 8 & GetSockName \\ Internet & 8 & InternetCrackUrIA \\ Kernel & 5 & NtDelayExecution \\ Threading & 5 & NtTerminateThread \\ Menu and Resources & 3.3 & LoadStringW \\ Error handling & 3 & SetUnhandledExceptionFilter \\ Data access and storage & 3 & RemoveDirectoryA \\ System & 2.6 & GlobalMemoryStatus \\ Developer & 2.2 & GetUserNameW \\ COM/OLE/DDE & 2 & CoInitializeSecurity \\ Shell & 1 & ShellExecuteExw \\ Services & 1.1 & IWbemServices\_ExecQuery \\ Network & 1 & NetUserGetInfo \\ Process & 1 & Process32 NextW \\ Input/output & 1 & GetKeyState \\ Device & 0.4 & DeviceControl \\ IP helper & 0.4 & GetAdaptersAddresses \\ Remote procedure call & 0.4 & UuidCreate \\ DNS & 0.4 & DnsQuery\_A \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Overall categorisation of 266 APIs with % score It shows the importance of monitoring network activities to detect and thwart malware that relies on network sockets for malicious operations. The Internet category (8%) reflects the malware's engagement in online activities, possibly for data exfiltration, command and control communication, or downloading additional payloads. Vigilant monitoring of these APIs can be instrumental in identifying and mitigating these threats. The kernel category (5%) is indicative of the malware's attempts to access and manipulate core system functions. This level of interaction suggests a sophisticated approach to control system operations at a fundamental level, making these APIs critical points for monitoring to prevent deep system intrusions. The threading category (5%) indicates that malware often employs multithreading techniques to evade detection and enhance efficiency. This insight can guide the development of more sophisticated detection mechanisms that can identify and counteract such evasive tactics. The error handling category (3%) demonstrates the malware's capability to manage errors effectively, indicating a level of sophistication in maintaining operational stability while avoiding detection. This aspect highlights the need for advanced analytical tools capable of discerning such subtle operational patterns.