# Research on the Construction of Malware Variant Datasets and Their Detection Method
## 2 Related Work  
There has been a lot of related work on malware static and dynamic detection, which has played an important role in malware detection. Most of the modern anti-malware engines, such as Windows Defender6, Avast7, Deep Insinct D-Client8 and Cylinder Smart Antivirus9, are powered by machine learning, making them robust against emerging variants and polymorphic malware [6]. Malware detection also has important applications in Cloud Infrastructure as a Service (IaaS). IaaS is more vulnerable to malware attacks due to exposure to external adversaries [18]. In IaaS, dynamic online malware detection is also an important application by detecting the fine-grained process system characteristics of the process runtime [19; 20].  
Meanwhile, to avoid detection, malware manufacturers have developed many malware obfuscation methods, including packing [21], encryption, invalid instruction insertion, instruction replacement and instruction reordering. Since obfuscation methods such as packing and encryption usually do not change malware behavior, they have no impact on the dynamic detection method. This is one of the reasons why dynamic detection has been widely studied. However, instruction insertion, replacement and rearrangement in the malware API call sequences may lead to the failure of dynamic malware detection methods. For example, [PERSON] et al. [22] presented a black-box attack against API call-based machine learning malware classifiers, focusing on generating adversarial sequences combining API calls and static features. It is shown that such an attack is effective against many traditional machine learning classifiers.  
To reduce the impact of obfuscation techniques on malware detection, [PERSON] et al. [23] constructed the document feature table of operation code segments for Android malware, which makes the operation code feature flexible to obfuscation and enhances the flexibility of malware classification by simplifying the semantics of the Dalvik operation code. [PERSON] et al. [24] used Cuckoo Sandbox to extract the API call sequence of the malware family, constructed a public dataset [25], and classified the malware family through a deep learning model. [PERSON] et al. [26] extracted the API call sequence by running benign software and malignant software in the sandbox and processing the API call sequence into a graph structure. On this basis, they proposed a malware detection method based on a depth graph convolution neural network (DGCNN).  
The set of obfuscated API sequences is the basis for the abovementioned malware detection methods. However, it is difficult to obtain enough obfuscated API sequences of real malware. To obtain obfuscated samples of API sequences, [PERSON] et al. [27] carried out the operations of system call insertion, reordering and replacement when running a malware in a sandbox. However, since the altered objects are API sequences, they cannot be restored to the original program. In other words, these sequences are not necessarily the real behavior of malware. They cannot reflect the real behavior of malware variants after obfuscation. Meanwhile, deep learning techniques such as BERT and adversarial training have obvious advantages in dealing with noise problems. However, they have not been used to handle obfuscation problems in the malware detection field.  
Based on the above observations, this paper aims to carry out the following work: (1) construction of malware variants and their real API call sequence sets; (2) a malware variant detection method based on BERT and adversarial training; and (3) experimental evaluation of the proposed malware detection method toward malware with and without obfuscation.