## 2 Related Work  
This section discusses the existing research that has used ML for malware analysis, with a focus on API calls and feature extraction. Dynamic feature-based malware detection techniques are widely used to detect and classify unseen malware. These techniques typically inspect activities such as resource consumption, triggered system calls [19], invoked API calls [20], function-based features [21], and others to differentiate between malware and benign software. Usually, behaviour patterns are collected while the input file is executed in an isolated environment known as a sandbox. Numerous dynamic feature-based malware detection approaches that employ sandbox technology have been proposed over the years [22; 23]. [PERSON] et al. [13] used Cuckoo Sandbox to extract several API calls from several malware types. [PERSON] et al. [24] showed that, in the context of malware analysis, a sequence of API calls can be viewed as a set of transaction data, where each API call and its corresponding arguments form a collection of items that can potentially reveal patterns of behaviour that are indicative of malicious activity. [PERSON] et al. [25] utilised category weights for each malware family before selecting features and then performed feature selection based on the weights to ensure the accuracy of the classification task. [PERSON] et al. [26] employed API call sequences and frequency to identify and classify malware by utilising the Random Forest classifier. [PERSON] et al. [27] proposed a method to uncover the underlying patterns of malicious behaviour among different malware families by utilising the Jaccard index and visualisation techniques. [PERSON] et al. [28] and [PERSON] et al. [29] explained how ML techniques have been widely utilised in the field of malware detection. These techniques involve training classification algorithms using features extracted from malware samples. [PERSON] et al. [30], [PERSON] et al. [31], [PERSON] et al. [32], and [PERSON] et al. [33] employed Random Forest classifiers to detect malware based on PE file characteristics and network behaviours. Similarly, [PERSON] et al. [34], [PERSON] et al. [35], and [PERSON] et al. [36] developed Random Forest classifiers to detect malware using features such as system calls, file system activities, and Windows registry information. [PERSON] and [PERSON] [37] proposed an approach focused on extracting the most significant features from malware PE files to reduce data dimensionality. In addition, [PERSON] et al. [38] and [PERSON] et al. [39] compared the performance of various ML algorithms for PE malware detection. They found that XGBoost and logistic regression exhibited the best performance among the tested methods. Due to the varying lengths of API call sequences, it can be challenging to identify robust features for malware detection. To address this issue, researchers have proposed using deep learning models based on API request sequences. Recurrent neural networks (RNNs) are particularly effective in handling time-series sequences, especially in the field of natural language processing. [PERSON] et al. [40] utilised an RNN model to classify malware families, with Long API call sequences used as the basis for categorising different types of malware. [PERSON] et al. [41] utilised RNNs and features extracted from API requests to differentiate between malware and benign files. [PERSON] et al. [42] proposed a method of converting API calls into a graph structure by using the depth graph convolution neural network (DGCNN) to distinguish between malware and legitimate samples. [PERSON] et al. [43]proposed a method to represent malware behaviour by converting API calls to images based on a colour-mapping criterion by using a convolutional neural network (CNN). The work by [PERSON] et al. [44] introduced the concept of API call topics as a way to identify similar malware samples based on their API call behaviour.