# Deep Learning Model with Sequential Features for Malware Classification
## 3 Malware Classification Method Based on Sequence Features and Deep Learning
### Features Extraction  
(1) Malware opcode features  
Programs are sequential instructions, and the underlying operation of a computer consists of the execution of instructions. Instructions generally comprise two parts: opcodes and operands. One of the static features commonly used in malware detection is the opcode feature. Batch disassembly is performed using the IDA pro tool on an executable PE file to obtain the.asm file with opcode sequence. The.asm file is generally divided into three segments: text,.data, and.bss. The opcodes in the.text segment are shown in Figure 6.  
An opcode can usually be divided into four categories: data movement, arithmetic or logic, control flow types, and others, from which the more important opcodes are filtered to extract the opcode sequence text. The opcode codes category is shown in Table 1.  
Figure 6 shows a sample of 0A32 eTdBKayCWhZqDQ. The opcodes in each.asm file are sequentially extracted by regularization. The extracted opcode sequence text is shown in Figure 7.  
The opcode sequences differ. Some are extremely long, so to extract more complete information, the method based on n-gram in natural language processing is used to extract the opcode features. By treating each opcode as a word, the n-gram method takes \begin{table}
\begin{tabular}{l l} \hline \hline
**Category** & **Operation Codes** \\ \hline Data move & mov, movzx, push, pop, lea, xchg \\ Arithmetic/logic & add, sub, inc, dec, imul, or, xor, shl, shr, nor, rol \\ Control flow & jmp, jz, cmp, jnb, call, retf, retn \\ Other & nop \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Operation codes. Figure 6: Original opcode sequence. Figure 7: Opcode sequence after pre-processing. subsequences of the opcode sequence according to the magnitude of the n value with a sliding window, and then the frequency of the corresponding subsequence is calculated. Then, a word frequency threshold is set, and the subsequence with a particular number of occurrences above the threshold is retained. The retained subsequence is a feature of the malware. (2) Malware bytecode features  
The malware itself is a file consisting of a series of bytes. One idea is to convert the binary file of malware into a grayscale image using the similarity between the values of the bytes and the range of pixel values taken in the grayscale image. The classification of malware families is achieved based on the texture similarity of grayscale images of the same family of malware and the different textures due to the different structures of different families of malware. To detect similar variants of malware, binary files can be better differentiated such that the impact of obfuscation is reduced. Malware is converted into a sequence consisting of a binary, and the hexadecimal.byte file is read in binary, then divided by 16 bits in order, and converted into decimal values within [0, 256]. The first line number of each byte file is ignored, and only the hexadecimal values after the line number are extracted. Only the values and letters in the byte file are kept, and the rest of the symbols are replaced with zeros, thus converting the malware file into a one-dimensional vector of decimal numbers. The steps for extracting bytecode sequence features from malware are shown in Algorithm 1. ```
Input: hexadecimal file; Output: a one-dimensional vector-matrix representation of file byte sequence. 1 function getMatrixfromfile
2. f = open(file,\"rb\"); /*read the file in binary */
3. hexst = binascii.hexlify(f); /*convert binary file to a hexadecimal string */
4. \(\text{Byte}=\text{np.array}(\left[\text{int}(\text{hexst}\left[\text{i:i+2} \right],\,16)\text{ for i in range}(0,\,\text{len}(\text{hexst}),\,2)\right])\); /*convert the string to an unsigned decimal number by byte division into a byte*/
5. return byte;
6. end function
```  
**Algorithm 1** The hex file is converted to a sequence of decimal values within [0, 256]. Similarly, the length of the sequence of each sample varies.