## 3 Materials and Methods
### API Categorisation  
At this stage, the focus shifted towards categorising APIs based on the specific families they belonged to. This categorisation is essential for gaining granular insights into the roles these APIs play in malicious code execution. To facilitate this categorisation, a dedicated Python module was developed to rigorously analyse the APIs and assign them to their respective categories. By understanding which categories of APIs are most commonly used in malicious code, researchers and analysts can gain a deeper understanding of the techniques employed by malicious actors. Furthermore, it makes it possible to tailor security measures that are more responsive to these specific types of API calls. Step:3 in Algorithm 1 provides an overview of the function (CategoriesAPIs(_api_counts.csv_, \(\mathcal{M}\))), which categorises API call data stored in a CSV file (api_counts.csv) based on a provided mapping (\(\mathcal{M}\)) of APIs to categories. It reads the CSV data, iterates through each row, identifies relevant APIs present in the mapping, and creates a categorised dataset. The resulting dataset is written to a new CSV file (categorised_apis.csv), and the function returns the path to this categorized dataset file.  
\begin{table}
\begin{tabular}{c c c c c c} \hline
**SHA256** & **API-1** & **API-2** &... &... & **API-n** \\ \hline SHA-1 & 278 & 89 & 1 &... & 97 \\ SHA-2 & 1 & 0 & 15 &... & 124 \\... &... &... &... &... &... \\ SHA-n & 78 & 1567 & 56 &... & 0 \\ \hline \end{tabular}
\end{table}
Table 1: Dataset representation.  
```
Input :List of JSON reports from Cuckoo Sandbox (\(\mathcal{J}\)), VirusTotal API (\(VT_{api}\)), API to  Category Map (\(\mathcal{M}\)) Output :Labelled and categorised dataset (\(\mathcal{D}\)) /* Step 1: Dataset Generation */ FunctionExtractAPIsFromJSON(\(\mathcal{J}\)): \(APIs\leftarrow\{\}\); forreport in \(\mathcal{J}\)do \(api\_counts\leftarrow\textsc{PythonModule.extract\_api\_counts}(report)\); \(is\_malware\leftarrow\textsc{PythonModule.determine\_malware}(report)\); \(label\leftarrow\textbf{if}\textit{is\_malware}\textbf{then}\textbf{1}\textbf{else}\textbf{0}\); \(APIs[report]\leftarrow(api\_counts,label)\); WriteToCSV (\(APIs\), 'api\_counts.csv'); return'api\_counts.csv'; /* Step 2: Malware Classification */ FunctionLabelMalware(\(APIs\), \(VT_{api}\)): \(Labels\leftarrow\{\}\); forapi \(\in\)\(APIs\)do \(response\leftarrow\textsc{QueryVirusTotal}(api,\,VT_{api})\); \(Labels[api]\leftarrow\textsc{VotingMechanism}(response)\); return\(Labels\); /* Step 3: API Categorisation */ FunctionCategoriesAPIs(\(api\_counts.csv,\,\mathcal{M}\)): \(df\leftarrow\textsc{ReadFromCSV}(api\_counts.csv)\); \(CategorisedAPIs\leftarrow\textsc{CreateDataFrame}()\); for\(\textit{route}\in df\)do \(currentCategorisedAPIs\leftarrow\{\}\); for\(api\in\textit{row}\)do if\(api\in\mathcal{M}\)then \(currentCategorisedAPIs[api]\leftarrow\mathcal{M}[api]\); \(CategorisedAPIs\leftarrow\textsc{AppendRow}(CategorisedAPIs,currentCategorisedAPIs)\); WriteToCSV(CategorisedAPIs, 'categorised_apis.csv'); return'categorised_apis.csv';
```  
**Algorithm 1**Algorithm for generating labelled and categorised malware dataset