## 2 Related Work
### Malware Detection and Classification  
Traditional signature scanning-based techniques cannot effectively detect malware in real-time malware variants. To overcome these problems, many researchers have established static malware detection models based on techniques for machine learning by extracting static features, such as Windows PE file structure, opcodes, bytecodes, etc., before software execution. The types of columns in Table 1 show whether the study has an application for identifying or categorizing malware. If characteristics were taken from the PE body or header, it is indicated in the features column. All abbreviations are explained below:  
Figure 2: Visualizing malware as an image. BYT: byte code; OP: operation code; STC: structural feature; API: application programming interface. Finally, the model column shows the classification models used by the author. In 2019, [PERSON] et al. [29] advanced a static detection method to identify Windows malicious programs based on opcode sequences. This method identifies Windows malware of varying digits. Compared to previous systems, it reduces computational complexity and can efficiently detect and classify malware variants. In 2020, [PERSON] et al. [30] used APIs, byte entropy, DLLs, and altered registry entries to statically extracted 92 features from binary malware, obtaining 99.36% detection accuracy. In 2021, [PERSON] et al. [5] proposed an automated pipeline for detecting and classifying PE files. The pipeline first detects whether the sample is malicious. In the case of malware, the pipeline further determines the group of samples. Experimental findings indicate that the scheme achieves 96.9% classification accuracy on the EMBER dataset. An effective malware categorization method built on a deep learning algorithm was proposed by [PERSON] et al. [31]. The suggested approach addresses the issue of unbalanced data by applying a weighted loss function in the neural network model's classification layer. With an accuracy of 98.23% on the MalImg dataset, 98.46% on the BIG2015 dataset, and 98.21% on the MaleVis dataset, the testing findings demonstrate that it may greatly improve the malware classification performance. A technique (RMVC) based on opcode sequences for categorizing malware was suggested by [PERSON] et al. [32]. The system first converts malicious programs into grayscale images, then uses recurrent neural networks (RNN) for feature extraction, and finally uses convolutional neural networks (CNN) for image classification. The outcomes of the trial indicate that the RMVC model achieves 99.5% accuracy on a few samples. In 2022, using the assembly files and binary files of the Kaggle dataset, [PERSON] et al. [33] extracted 184 opcode features and 16 probabilistic features. They then fused all the features together using a double-byte feature encoding technique. The CNN algorithm was employed in the experiment to classify the fused samples, and the findings show that the suggested method has an accuracy rate of 98.68% and a logloss of 0.022. [PERSON] et al. [34] suggested a useful classification scheme based on malware texture features, which does not need to execute malware and effectively avoids terminal infection. The classification accuracy using a machine-learning classifier on the public MalImg dataset was 98.34%. [PERSON] et al. [35] proposed a method to predict malicious executable files using PE file header features. This method uses a limited number of features, which reduces the system's complexity while ensuring high accuracy. Using a dataset with features in PE file format, the model was trained and tested with an average accuracy of roughly 99.5%. A malware detection method based on neural networks and PE file API calls was proposed by [PERSON] et al. [2]. The experimental results show that the average accuracy rate can reach 97.9%. [PERSON] et al. [4] presented a static detection method incorporating machine learning to classify ransomware using opcode sequences extracted from assembly files.