## 3 Proposed Model
### Quantitative Hierarchy Analysis of Malware and Its MAs
#### 3.1.2 Creating and Learning Pairwise Comparison Matrix <Stage 2>  
In Stage 2, a pairwise comparison of each layer created in Stage 1 and a pairwise comparison between layers are performed; additionally, a matrix is created. At this time, the analysis result of a malicious API call of the malicious code is defined by dividing it into 12 categories in the Cuckoo Sandbox, which is a dynamic analysis tool. The results of an analysis of the activities of malicious codes in the Cuckoo Sandbox create the parameter values required for analysis. For example, if a dropper is generated in the analysis results, the index code is considered to be a backdoor action with MA\({}_{3}\) (Table 2), and it is used as a parameter value for a pairwise matrix. Thus, the API frequency, malicious code called, and activity analysis determine the relative importance between MAs. Additionally, through pairwise comparison, importance is assigned on a nine-point scale [15; 16] to indicate the degree to which an item contributes to the top elements. If the layer immediately below comprises \(n\) elements, \(n(n-1)/2\) comparisons are required. Next, a matrix is created from the pairwise comparisons of 51300 malwares according to their importance or the quantitative threat index of the malware that was identified in the primary analysis using the Cuckoo Sandbox. Here, the importance value is set \begin{table}
\begin{tabular}{c c c c} \hline \hline
**Index Code** & **Category** & **Index Code** & **Category** \\ \hline MC\({}_{1}\) & Ransomware & MC\({}_{6}\) & Exploit \\ MC\({}_{2}\) & Worm & MC\({}_{7}\) & Launcher \\ MC\({}_{3}\) & Downloader & MC\({}_{8}\) & Dropper \\ MC\({}_{4}\) & Botnet & MC\({}_{9}\) & Backdoor \\ MC\({}_{5}\) & Rootkit & MC\({}_{10}\) & Scareware \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Malware categories (MCs). \begin{table}
\begin{tabular}{c c c c} \hline \hline
**Index Code** & **Category** & **Index Code** & **Category** \\ \hline MA\({}_{1}\) & Banking Attack & MA\({}_{7}\) & Propagation \\ MA\({}_{2}\) & Abnormal Networking & MA\({}_{8}\) & Hocking \\ MA\({}_{3}\) & Anti-Debugging & MA\({}_{9}\) & Boot Attack \\ MA\({}_{4}\) & Info-Stealer & MA\({}_{10}\) & System Summary \\ MA\({}_{5}\) & System Falsification & MA\({}_{11}\) & Data Falsification \\ MA\({}_{6}\) & Social Attacking & MA\({}_{12}\) & Bypass \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Malicious activities (MAs). by using the quantitative threat indices that are created in open-source analysis tools other than the Cuckoo Sandbox, including commercial products. \[ \begin{array}{c|cccccccc}&MC_{1}&MC_{2}&MC_{3}&MC_{4}&...&MC_{10}\\ MC_{1}&\left[1\right.&c_{1,2}&c_{1,3}&c_{1,4}&...&c_{1,0}\\ MC_{2}&c_{2,1}=\left.1\right.c_{1,2}&1&c_{2,3}&c_{2,4}&...&c_{2,10}\\ MC_{3}&c_{3,1}=\left.1\right.c_{1,3}&c_{3,2}=\left.1\right.c_{2,3}&1&c_{3,4}&...&c_{3,10}\\ MC_{4}&c_{4,3}=\left.1\right.c_{1,4}&c_{4,2}=\left.1\right.c_{2,4}&c_{4,3}= \left.1\right.c_{3,4}&1&...&c_{4,10}\\...&...&...&...&...&...&...\\ MC_{10}&c_{10,1}=\left.1\right.c_{1,10}&c_{10,2}=\left.1\right.c_{2,10}&c_{1 0,3}=\left.1\right.c_{3,0}&c_{10,4}=\left.1\right.c_{4,10}&...&1\end{array}  \tag{1}\]  
Next, a matrix is created from pairwise comparisons between MAs that occur within a certain malware. \[ \begin{array}{c|cccc}&MA_{1}&MA_{2}&MA_{3}&MA_{4}&...&MA_{2}\\ M_{4}&\left[1\right.&a_{1,2}&a_{1,3}&a_{1,4}&...&a_{1,2}\\ MA_{4}&a_{2,1}=\left.1\right.a_{1,2}&1&a_{2,3}&a_{2,4}&...&a_{2,32}\\ MA\left.\right.&a_{3,1}=\left.1\right.a_{1,3}&a_{3,2}=\left.1\right.a_{2,3}&1& a_{3,4}&...&a_{3,12}\\ MA_{4}&a_{4,1}=\left.1\right.a_{1,4}&a_{4,2}=\left.1\right.a_{2,4}&a_{4,3}= \left.1\right./\left.a_{3,4}&1&...&a_{4,12}\\...&...&...&...&...&...&...\\ MA_{12}&a_{12,3}=\left.1\right.a_{1,2}&a_{12,2}=\left.1\right.a_{2,12}&a_{1,2,3}=\left.1\right./\left.a_{3,12}&a_{12,4}=\left.1\right./\left.a_{4,12} \right.&...&1\end{array}  \tag{2}\]  
For comparison, a basic pairwise comparison matrix between MAs is created for the case where 12 major MAs occur in each malware.