# Lightweight and Robust Malware Detection Using Dictionaries of API Calls
## 5 The Dictionary of API Calls  
Attackers receive benefits from previous attacks to develop new samples of malware with few changes. In this sense, we can infer that the API calls that exist in the malware category are affiliated with a limited dictionary and are frequently utilized in other samples. Investigating the dictionary of API calls used by malware and goodware could provide an opportunity to build a reliable classifier based on API calls, once a sufficient number of reliable and relevant examples are analyzed. Starting from this basis, initial statistics are crucial to understanding the trend of API calls in each category. Python scripts are created to automate the process of extracting the unique API calls for both malware and goodware. The results show that the number of unique API calls in dataset1 is 264 distributed over both categories with 252 and 200 API calls for malware and goodware, respectively, as shown in Figure 1(a). Although goodware constitutes a minority in dataset1, 200 API calls were found, which means most of the API calls are shared by malware and goodware in dataset1. This observation is very interesting and shows the limited number of API calls found in both classes which supports our assumption that the malware dictionary is limited, as attackers reuse the same tricks and techniques with few updates. This is supported by an examination of dataset3, which includes 278 distinct API calls shared by all malware families with rates that are extremely close to one another, as shown in Figure 1(b).  
The reusability of API calls reflects the trend of attackers' thinking. Figure 2(a) clearly depicts the higher reuse rate of API calls within the malware which can be understood as a reuse of previous tricks, although the goodware reuses the API calls as shown in Figure 2(b). However, the reuse rate is low compared with the case of malware which again confirms our assumption.  
Figure 3: The reuse rate of API calls in dataset1.  
Figure 2: The distribution of API calls in dataset1 and dataset3.  
The small number of goodware samples in dataset1 might make the aforementioned conclusions less strong. Also, this depends on the fact that only 100 sequences of API calls can hide a lot of useful information. Therefore, 3135 malware samples were randomly taken from dataset1, and the goodware samples of dataset1 were combined with goodware samples taken from dataset2 to complete a total of 3135 samples to generate a balanced dataset. In order to obtain the complete sequences of API calls, the MD5 hashes of the samples are provided to VirusTotal [42] through the API interface, resulting in the generation of a JSON report. Following this process, the API calls are extracted and analyzed. Once again, the analysis results are consistent with our previous assumption. The number of unique API calls extracted from malware was 4567. This number is very limited compared with the 34,945 API calls achieved from goodware. Furthermore, drawing the reuse rate of the full API calls for both malware and goodware, it can be observed that the reuse rate is still higher in malware as shown in Figure 4. This confirms the limitation API call dictionary for malware class. This shows that our suggested API calls analysis could offer superior discriminatory qualities to be a foundation for a reliable classification model. The next section presents the construction process of a classification model that only depends on an API calls dictionary.