## 3 The Proposed System
### Feature Extraction
#### 3.3.2 Assembly File  
Asm_Pixel: Assembly files contain much software-related texture information. Therefore, the image representation transformation of the assembly file can effectively utilize its texture information to classify malware [26]. This paper converted all pixelated images to a NumPy array and used cross-validation to find a feature set consisting of 2300 significant pixel features from each malware image.  
Asm_1_gram: Numerous studies have found that some features of assembly files, such as segments, opcodes, keywords, and registers, are closely related to malicious activities of malware, which can effectively distinguish malware families. The Microsoft Challenge  
\begin{table}
\begin{tabular}{l} \hline \hline
**Hex view** \\ \hline
00401000 00 00 80 40 40 28 00 1C 02 42 00 C4 00 20 \\
00401010 00 00 20 09 2A 02 00 70 00 03 5E 10 31 0A \\
00401020 40 00 02 01 00 90 21 00 32 40 00 1C 01 40 \\ \hline \hline
**Assembly view** \\ \hline.text:00401000 56 push esi \\.text:00401005 50 push ex \\.text:00401005 50 assume es: nothing \\ \hline \hline \end{tabular}
\end{table}
Table 2: Data overview.  
provided 10,868 assembly language files totaling 150 GB. Due to the huge source data is not conducive to feature extraction, this paper adopts parallel processing technology to randomly divide all assembly files into five folders, and each folder simultaneously extracts these four types of features. Details are as follows:  
1. Segments: The preset sections in PE (.text,.data,.bss,.rdata,.edata,.idata,.rsrc, etc.). We selected 13 commonly used segments, and the experiments prove that these segments benefit the classification results;
2. Opcodes: The machine code, which represents the assembly instruction, is represented by the opcode as a helper. The full list of \(\times 86\) instruction sets is vast and complex, so we chose a subset of 26 opcodes based on how frequently they are used in malware samples. We measured how frequently these 26 opcodes were used in each malware sample;
3. Keywords: Extracted three keyword features:.dll, std::, and :dword;
4. Registers: Extracted the features of registers edx, esi, eax, ebx, ecx, edi, ebp, esp, and eip and experimentally demonstrated that the frequency of register usage is a helpful feature for assigning malware samples to a family.  
Opcodes_2_gram: The opcode is a command that defines the behavior of malware that does not rely on any external resources or domain knowledge. [PERSON] et al. [36] found that opcodes have higher accuracy by comparing malware classification performed by assembly and application programming interface (API) call sequences. Hence, we constructed 565-dimensional Opcodes_2_gram frequency features from assembly files.  
Opcodes_3_gram: Malware has more sophisticated malicious patterns due to the use of techniques such as code reuse and automation. More machine code accompanies common operations of most malware. Therefore, if the value of \(n\) in the \(n\)-gram is small, more complex malicious operation codes cannot be effectively discovered. Therefore, this paper extracted 2000-dimensional Opcodes_3_gram frequency features after Opcodes_2_gram.