# A Simhash-Based Integrative Features Extraction Algorithm for Malware Detection
## 3 Methods
### Integrative Features Extraction
#### 3.3.2 Integrative Process  
The simhash algorithm is used to integrate the dynamic and static information to form features in this paper, and some improvements are made in the process of segmenting and weighting. The process is shown in Figure 3.  
Figure 3: Integrative feature extraction. Figure 2: The process of the simhash algorithm. The process is mainly divided into five steps: data preprocessing, weight calculating, hash, weighting and merging. **A. Data Preprocessing**  
For a certain sample \(S\), the API function information captured by static analysis is expressed as the API call sequence, \(X_{s}=\left\{x_{1},x_{2},\ldots,x_{t},\ldots,x_{m}\right\}\), according to the results of monitoring by the.dll modules, where \(x_{t}\) represents the \(t\)-th function called, and \(m\) represents the total number of call functions. Then, dynamic analysis is used to extract the file behavior information, the process behavior information, the registry behavior information, and the network behavior information, which are respectively represented as corresponding sequences according to the execution sequence of each behavior; these are the file behavior sequence, \(F_{S}=\left\{f_{1},f_{2},\ldots,f_{i},\ldots,f_{a}\right\}\), the process behavior sequence, \(P_{s}=\left\{p_{1},p_{2},\ldots,p_{j},\ldots,p_{b}\right\}\), the registry behavior sequence, \(R_{s}=\left\{r_{1},r_{2},\ldots,r_{k},\ldots,r_{c}\right\}\), and the network behavior sequence, \(N_{s}=\left\{n_{1},n_{2},\ldots,n_{l},\ldots,n_{d}\right\}\), where: \(f_{i}\) is the \(i\)-th file behavior of the execution; \(p_{j}\) is the execution of the \(j\)-th process behavior; \(r_{k}\) is the execution of the \(k\)-th registry behavior; \(n_{l}\) is the execution of the \(l\)-th network behavior; \(a\), \(b\), \(c\), and \(d\), respectively indicate the length of each sequence of behavior; and, \(A_{S}=\left\{F_{S},P_{S},R_{S},N_{S}\right\}\). **B. Weight Calculating**  
Since the sequence of the API function is the same as the integrative process of each behavior sequence, the API function sequence, \(X_{S}\), and the file behavior sequence, \(F_{S}\), are selected as examples for explanation of weight calculating. The weights are defined as follows:  
**Definition 1. **_API function sequence weight \(w_{t}\). The weight level is defined as 2. For each function, \(x_{t}\), in the sequence, if \(x_{t}\) is related to the integrative behavior information, the weight is 2; otherwise the weight is 1._  
**Definition 2. **_File behavior sequence weight \(w^{\prime}_{i}\), whose weight is the number of times each behavior information, \(f_{i}\), in \(F_{S}\), is repeated in the sequence._  
Calculating the weights of \(X_{S}\) and \(F_{S}\) as shown below:  
\[W_{X_{S}\cup F_{S}}=\left\{(x_{1},w_{2}),\ldots,(x_{t},w_{t}),\ldots,(x_{m},w _{m}),(f_{1},w^{\prime}_{1}),\ldots,(f_{i},w^{\prime}_{i}),\ldots,(f_{a},w^{ \prime}_{a})\right\} \tag{1}\]  
**C. Hash**  
Each of the values in \(X_{S}\) and \(F_{S}\) is hashed and mapped to a binary number of b-bits, and the calculation result is as follows:  
\[ \begin{array}{l}H_{X_{S}\cup F_{S}}=\left\{(hash(x_{1}),w_{1}),\ldots,(hash (x_{t}),w_{t}),\ldots,(hash(x_{m}),w_{m}),\right.\\ \left.(hash(f_{1}),w^{\prime}_{1}),\ldots,(hash(f_{i}),w^{\prime}_{i}), \ldots,(hash(f_{a}),w^{\prime}_{a})\right\}\end{array}  \tag{2}\]  
**D. Weighting**  
\(H_{X_{S}\cup F_{S}}\) is weighted by every bit. If a bit in \(hash(x_{t})\) or \(hash(f_{i})\) is 1, then \(+w_{t}\) or \(+w^{\prime}_{q}\); if it is 0, then \(-w_{t}\) or \(-w^{\prime}_{q}\). For example, if the hash value is 101110, the weight is 2, and the result of the weighting calculation is 2\(-\)2222\(-\)2. Therefore, each element in \(H_{X_{S}\cup F_{S}}\) is represented as a sequence of numbers of b-bits, resulting in \(H_{X_{S}\cup F_{S},b-bits}\). **E. Merging**  
Each b-bits sequence in \(H_{X_{S}\cup F_{S},b-bits}\) is accumulated and merged to obtain a final b-bits sequence.