## 3 Results
### Performance Evaluation
#### 3.1.1 Results of BiLSTM, BiGRU, and GRU-GAN Models during Training on Dataset 1 and Dataset 2  
The training performance of the BiLSTM, BiGRU, and GRU-GAN models on dataset 1 is depicted in Figures 3 and 4. Both the BiLSTM and BiGRU models demonstrated rapid convergence during the initial training epochs, achieving over 90% accuracy for both training and validation sets by epoch 5. While BiGRU exhibited slightly more volatile training accuracy, both models ultimately converged to comparable final accuracies of approximately 96-97%. The corresponding loss curves for both models showed a similar pattern of rapid initial decrease followed by gradual stabilization at low levels. These results show that both BiLSTM and BiGRU are effective models for the task of malware classification. On the other hand, the GRU-GAN model exhibited a more rapid initial learning curve, surpassing 95% accuracy by epoch 5. This learning ability captured discriminative features faster compared to the BiLSTM and BiGRU models. While maintaining a slight accuracy advantage throughout training, the GRU-GAN ultimately converged to final accuracies of approximately 98-99%. While achieving higher classification accuracy, the GRU-GAN exhibited a marginally higher final loss, potentially due to a lack of diversity in the generated data. Figures 5 and 6 illustrate the training performance of the BiLSTM, BiGRU, and GRU-GAN models on dataset 2. Both the BiLSTM and BiGRU models demonstrated comparable performance, with rapid initial accuracy gains and subsequent gradual improvement. The training accuracy for both models consistently outperformed the validation accuracy by a small margin. Final accuracies of approximately 95-97% (training) and 94-96% (validation) were achieved after 30 epochs. The corresponding loss curves illustrate this  
Figure 4: Discriminator accuracy and validation loss of the GRU-GAN model on dataset 1. Figure 3: Accuracy and validation loss of the BiLSTM and BiGRU models on dataset 1.  
pattern, showing a sharp initial decrease followed by a more gradual decline. The close convergence of training and validation losses depicts minimal overfitting of the models. The GRU-GAN model exhibited a distinctive learning pattern characterized by a rapid initial increase in accuracy and sustained training-validation gap. While achieving near-perfect training accuracy, the validation accuracy plateaued around 97-98%. The corresponding loss curve demonstrated a steep initial decline followed by a more gradual decrease. While all three models performed well in classifying API call sequences, the GRU-GAN model showed slightly superior final accuracy. Figure 5: Accuracy and validation loss of the BiLSTM and BiGRU models on dataset 2. Figure 6: Discriminator accuracy and validation loss of the GRU-GAN model on dataset 2. .1.2 Performance Metrics of BiLSTM, BiGRU, and GRU-GAN Models on Dataset 1, Dataset 2, and Dataset 3  
On dataset 1, shown in Figure 7A, the BiLSTM model showed a relatively high number of TN (correctly identified benign files) and TP (correctly identified malware) but also exhibited some FP and FN. For instance, it correctly identified 3986 benign files (TN) and 5595 malware files (TP) but misclassified around 242 benign files as malware (FP) and 208 malware files as benign (FN). The BiGRU model demonstrated similar performance, with lower FP but higher FN rates. In contrast, the GRU-GAN model demonstrated near-perfect classification, with TN and TP values of 4228 and 5798, respectively. Notably, the GRU-GAN model did not misclassify benign samples as malware (FP) but misclassified five malware samples as benign. Figure 7B, representing dataset 2, shows a slight decline in performance for BiLSTM and BiGRU. The BiLSTM model, for example, correctly identified 246 benign files (TN) and 227 malware files (TP) but misclassified approximately 15 benign files as malware (FP) and 26 malware files as benign (FN). The BiGRU model showed similar trends.