## 4 The Proposed Method
### Extraction Malicious Function Identifiers
#### 4.4.3 Extraction Function Identifiers  
In this step, the high attention score regions of the attention map are selected, and malicious behavior-related class and method names are extracted based on the selected regions of the attention map. High attention score regions are regions in an attention map where the values are particularly high, indicating that the model is focusing more attention on those specific parts of the input data. To select regions in the attention map, the values are sorted in descending order, and only the values with the top p% are used, where p% is predetermined. Applying Equations (12) and (13), the attention map is filtered to remove values below a certain threshold, which helps highlight the relevant features in the data.  
Instead of extracting information from as many regions as possible, selecting only the most suitable regions is more efficient [35].  
\[AM^{\prime}[i,j]=\left\{\begin{array}{cl}AM[i,j]&if\ AM[i,j]\geq c\\ 0&if\ AM[i,j]<c\end{array}\right. \tag{12}\]  
\[c=a[\lceil(N\times p)\rceil] \tag{13}\]  
where \(AM\) is an attention map. \(i\), \(j\) are the coordinates of the attention map. \(AM^{\prime}\) is a filtered attention map. \(a\) is the attention map changed to a one-dimensional array and sorted in descending order. \(p\) is the pre-determined percentile value, given as a rational number between 0 and 1. \(N\) is the total number of elements in the attention map matrix.  
The following Algorithm 2 is used to change the coordinates of the selected regions to the original dex offset values.  
```
0:\((x,y)\)\(\triangleright\) Attention Point Coordinate
0: List with DEX Offset
1:functionConvertToDexOffsets(\(x\),\(y\))
2:\(x^{\prime}=x\times(original\_image\_size/resized\_image\_size)\)
3:\(y^{\prime}=y\times(original\_image\_size/resized\_image\_size)\)
4:\(dex\_mm\_list=List(3)\)
5:\(mm\_idx=((y^{\prime}\times original\_image\_size)+x^{\prime})\times 3\)
6:\(dex\_mm\_list[0]=mm\_idx\)
7:\(dex\_mm\_list[1]=mm\_idx+1\)
8:\(dex\_mm\_list[2]=mm\_idx+2\)
9:return\(dex\_mm\_list\)
10:endfunction
```  
**Algorithm 2** Coordinate Conversion Algorithm.  
Once the region is selected, the DEX components of the selected region should be found. This is performed by converting the selected region to a DEX offset. The process is the reverse of converting the DEX file to an image. In Algorithm 2, first, the scale of the resized image used for the model is calculated. To obtain the offset of the DEX, the coordinates of the selected area are multiplied by the scale of the resized image. Due to the RGB image being used, 3 bytes of the original image were changed to 1 pixel. The first DEX offset is added by 1 and 2 to get three offset values. These are the offset values in DEX. With the DEX offset values obtained, we search for data in the \(dex\_section\_data\_map\) in Section 4.4.1.  
Finally, the fully qualified names of classes and methods related to the malicious behavior are extracted. Based on the selected regions in the attention map, the values fetched from the \(dex\_section\_data\_map\) have DEX field values. This is the information that the malware detection model uses to determine maliciousness. In the \(dex\_section\_data\_map\), the fields related to class and method are stored; thus, getting the class and method names for the data used to determine maliciousness is possible. Here, we can take the class and method names and sort them by frequency of appearance.