## 4 Experiments and Results
### Similarity Analysis and Classification  
The cross method proposed in this research is based on static and dynamic analysis, where the executable malware is disassembled. Hereafter, the similarity analysis is performed for each dissembled executable (\(\beta\)), which represents the vector of functions m, n where \(\left(\beta^{\prime}\right)\) is the variant malware of the original executable (\(\beta\)). Each function is represented as an array of vectors of functions. Therefore, we use (\(\beta\)) and \(\left(\beta^{\prime}\right)\) to compute the similarity which gives us a measure as a reference for the similarity of coefficients with values between 0 and 1. Should the two vectors be similar, the value is 0 while should they not be similar, the value is 1. The obtained value is then compared to a giventhreshold value (e.g., 0.5, 0.6, or 0.7). The threshold of similarity (8) was chosen for the purpose of the empirical result [44; 45; 46; 47].  
In this research, different methods have been tested for similarity analysis:  
* **Minkowski Distance**: _The Minkowski distance between two \(n\)-dimension vectors \(A\) and \(B\)_ is given by: \[D(A,B)=\left(i{\sum\limits_{i=1}^{n}{{{\left|{{A_{i}}-{B_{i}}}\right|}^{p}}}} \right)^{1/p}\] (4)  
The Minkowski Distance can be considered as a generalization of both the Euclidean distance and the Manhattan distance. When \(p=1\), it corresponds to the Manhattan distance and when \(p=2\), it corresponds to the Euclidean distance.  
* **Cosine Similarity:** Cosine similarity is a measure of similarity between two vectors based on the cosine of the angle between them. The vectors \(A\) and \(B\) are usually the term frequency vectors. The Cosine similarity between vectors \(A\) and \(B\) is given by: \[similarity=\text{Cos}(\theta)=\frac{A.B}{||A||||B||}=\frac{\sum\limits_{i=1}^{n}{{{ A_{i}}x{B_{i}}}}}{\sqrt{\sum\limits_{i=1}^{n}{{{\left({{A_{i}}}\right)}^{2}}}} \sqrt{\sum\limits_{i=1}^{n}{{{\left({{B_{i}}}\right)}^{2}}}}}\] (5)  
The resulting similarity ranges from \(-1\) meaning exactly opposite, to \(1\) meaning exactly the same, with \(0\) indicating orthogonality or decorrelation, while in-between values indicate intermediate similarity or dissimilarity.  
* **Containment Broder:** Containment border defines the containment for comparing two documents. The function \(f\) (\(0\)) computes sets of features from two documents, \(h\) and \(i\), such as fingerprints of \"shingles\". The _containment_(\(h\), \(i\)) of h within \(i\) is defined as: \[containment(h,i)=\frac{|f(h)\cap f(i)|}{|f(h)|}\] (6)
* **Canberra Distance**: The Canberra distance is a weighted version of the Manhattan distance, introduced and refined in 1967 by [PERSON], [PERSON], and [PERSON] [48]. It is often used for data scattered around an origin, as it is biased for measures around the origin and very sensitive for values close to zero. \[D=\frac{\sum_{i}{{{\left|{{u_{i}}-{v_{i}}}\right|}}}}{\sum_{i}{{{\left|{{u_{i }}+{v_{i}}}\right|}}}}\] (7)
* **Longest Common Subsequence (LCS):** The _LCS_ is used to find the longest subsequence common to all sequences in any two given strings \(P\). To extract the common API call sequence pattern among malware, the longest common subsequences (LCSs) is used. The formula is shown in (8). In the formula, \(P_{i}\) and \(Q_{i}\) represent the \(i\)th character of sequences \(P\) and \(Q\), respectively. For example, the LCSs of TKMN and TMK are TK and TM: \[LCS\big{(}P_{i},Q_{j}\big{)}=\left\{\begin{array}{ll}\varnothing&if\,i=0\, or\,j=0\\ LCS\big{(}P_{i-1},Q_{j-1}\big{)}&if\,p_{i}=q_{j}\\ longest\big{(}LCS\big{(}P_{i},Q_{j-1}\big{)},LCS\big{(}P_{i-1},Q_{j}\big{)} \big{)}&if\,p_{i}\
eq q_{j}\end{array}\right.\] (8)