# Features Engineering to Differentiate between Malware and Legitimate Software
## 5 API Call Visualisation
Table 4 indicates that all classifiers' performance is quite comparable on the imbalanced data set. Although training on an imbalanced data set makes models biased toward malware class, all evaluation metrics stated high scores which reflect the effectiveness of the models in detecting malware and

Figure 8: The workflow of malware detection using API call frequency. \begin{table}
\begin{tabular}{l c c c} \hline \hline  & **RF** & **KNN** & **SVM** \\ \hline F1 Score & **0.91** & 0.89 & 0.86 \\ Precision & **0.92** & 0.89 & 0.88 \\ Recall & **0.91** & 0.89 & 0.86 \\ Accuracy & **0.91** & 0.88 & 0.85 \\ \hline \hline \end{tabular}
\end{table} 
Table 3: Detection Model Results (Balanced Data set). goodware. The RF classifier presented the best performance on balanced and imbalanced data sets. Therefore, RF was selected for comparison with deep learning solutions. ### Comparisons, Discussion and Limitations

Two state-of-the-art deep learning classifiers (DGCNN and LSTM [36]) and one shallow model (CatBoost [40]) were selected for comparison due to their success in building models based on API call sequences to detect malware. Additionally, for fair comparison with [36, 40] which uses the same data set described in Section 4 to build different shallow machine learning and deep learning models, the same evaluation metrics: F1 score, precision, and recall, are used for comparison. The performance results of RF are pretty equal to deep learning techniques on both balanced and imbalanced data sets, as shown in Tables 5 and 6, respectively. According to these findings, RF traditional classifier-based API call frequency provides a performance similar to deep learning-based API call sequences solutions. The RF model has a tendency to converge to a suitable solution faster. Additionally, the RF is less complex than deep learning classifiers. This suggests the prospect of performing inference in a real-time setting using RF on edge devices. The imbalanced data set with only 1079 samples of goodware is considered one of the limitations of this work. Although the visualisation of the first 500 samples of malware and goodware draws a clear indication about the relation and sharing of API calls within malware and goodware, high computing resources are needed for the depiction of this Jaccard similarity. Therefore, considering only 500 samples for visualisation due to resource restriction is another limitation of this work. ## 9 Conclusions

Malware API calls were used in this study as classification features to detect malicious software. Extracting the API calls from the parent process only and considering the first 100 non-consecutive repeated calls provides recognition of the malicious behaviour as early as possible. Additionally, the network of similarity provides valuable information about how malware uses the same combinations of API calls and can uncover the malware creator trend. There was significant success in using API call sequences as a time series with neural \begin{table}
\begin{tabular}{l c c c c} \hline \hline  & **RF** & **CatBoost [40]** & **DGCNN (Model 2) [36]** & **LSTM [36]** \\ \hline F1 Score & **0.99** & 0.89 & 0.99 & 0.99 \\ Precision & **0.99** & 0.96 & 0.99 & 0.99 \\ Recall & **0.99** & 0.84 & 0.99 & 0.99 \\ \hline \hline \end{tabular}
\end{table} 
Table 6: Comparative analysis with cutting-edge works (Imbalanced Data set). \begin{table}
\begin{tabular}{l c c c} \hline \hline  & **RF** & **KNN** & **SVM** \\ \hline F1 Score & **0.99** & 0.98 & 0.98 \\ Precision & **0.99** & 0.98 & 0.99 \\ Recall & **0.99** & 0.98 & 0.99 \\ Accuracy & **0.98** & 0.98 & 0.98 \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Detection Model Results (Imbalanced Data set). \begin{table}
\begin{tabular}{l c c c c} \hline \hline  & **RF** & **CatBoost [40]** & **DGCNN (Model 2) [36]** & **LSTM [36]** \\ \hline F1 Score & **0.91** & 0.87 & 0.92 & 0.84 \\ Precision & **0.92** & 0.96 & 0.92 & 0.83 \\ Recall & **0.91** & 0.82 & 0.91 & 0.85 \\ \hline \hline \end{tabular}
\end{table}