## 3 Methodology
### Models
#### 3.3.2 MalCode2 Vec  
We need to convert input text into a numeric vector representation to make it feedable to the deep learning model. For example, given the script code from our dataset _s1_ = 'BC _dcesdlochgpDERXGdces nil()R77)R7 KKKH BCZ', and s2 = 'exch dup length2 index length add string dup'_, we can encode them using one-hot encoding. In one-hot encoding, each token of the sentence is represented as binary features in a row, where a feature receives a 1 if it corresponds to the original category and 0 otherwise. Thus, if our vocabulary consists of the words [BC, dcesdlochgpDERXGdces, nil)R77)R7 KKKH, BCZ, exch, dup, length2, index, length, add, string], the word 'exch' is represented as [0,0,0,0,1,0,0,0,0,0]. We employed two approaches to generate vector representation: (1) integer encoding and (2) MalCode2 Vec. Integer encoding transforms each text into sequential integers ranging from one to the total number of features. In the example, two sentences are represented as [1 2 3 4] and [5 6 7 8 9 10 11 6 6], where 1\(\sim\)11 corresponds to the defined vocabulary. However, this method does not capture the relationship between words; it only sequentially maps each word into a number. Language naturally has a distancing mechanism based on associations between words or characters. There is an association between script codes in tags and script languages. Therefore, we constructed a script code association dictionary using Word2 Vec to capture these associations better.  
Word2 vec is designed to learn associations between words from a large corpus using a neural network model. We constructed a pre-trained embedding model, MalCode2 Vec, using our malware dataset and used it to represent malware. The model was trained using the same architecture as Word2 Vec [13]. The efficiency of Word2 Vec stems from its ability to  
Figure 4: Overview of the proposed method.  
group vectors of related words (e.g., malicious and malware). The model learns the vector representation of words from the training data. Words with common contexts in the corpus are allocated close to each other in the vector space, operating under the assumption that the meaning of a word can be inferred from its nearby words. The MalCode2 Vec model was obtained using continuous bag-of-word (CBoW) and skip-gram methods. In the CBoW model, the model learns to predict a target word from the surrounding context words.  
The skip-gram model is the inverse of CBoW; it predicts surrounding words given the target word. The skip-gram model excels at capturing semantic relationships (i.e.,'malware' is closer to 'virus'), where CBoW is more proficient at learning syntactic relationships (i.e., 'virus' is close to 'viruses'). Skip-gram functions efficiently with a small amount of data, even representing rare words well, whereas CBoW performs better with more frequent words. Figure 5 shows the skip-gram model. The input layer comprises a one-hot encoded vector of size \(V\) (vocabulary size), where every vector is zero except for the target word \(t\). The random initialized input weight matrix (W\({}_{VN}\)) transforms the input into a hidden (projection) layer of an \(N\)-dimension vector. Each row of W\({}_{VN}\) represents the \(N\)-dimension vector associated with the respective word in the input layer. The output weight matrix, W\({}^{\prime}\)\({}_{NV}\), serves as the embedding matrix for context words. Multiplying the output weight matrix within the hidden layer yields a dot product vector of size \(V\). The softmax function is then applied to compute the probability distribution (score) of each unique vocabulary in \(V\) appearing in the context of \(t\). Finally, the error is calculated between the score and the one-hot vector of the context words, and optimization is performed through backward propagation. In our study, we trained the skip-gram model with a vector length of 100 features and a window size of three.