# A Malware Detection Framework Based on Semantic Information of Behavioral Features
## 2 Related Work
### Natural Language Processing and Deep Learning for Malware Detection  
Recently, many studies have combined natural language processing with deep learning to apply it to feature processing of malicious code, using word embedding to vectorize the features.  
[PERSON] et al. [43] implemented malware classification by using deep belief networks (DBN) through a deep stack of denoising autoencoders. The sandbox-generated log files were transformed into fixed-size strings using the most common method in natural language processing, the 1-g approach. The commonly used 20,000 words were extracted to form a dictionary, and then a binary vector was produced by checking which of these words existed for each text sample. [PERSON] et al. [44] designed a framework that used a weighted random walk method to obtain a sequence of opcodes and performed feature learning on the opcode graph. After that, a vectorized representation was performed using Word2 Vec. By applying the random walk method for edge and node selection to avoid handling lengthy operation code sequences, a vector space consisting of low-dimensional sequential opcode embeddings was constructed with extremely high accuracy. [PERSON] et al. [30] employed an LSTM-based word embedding method, combining the strengths of signature-based and heuristic approaches, to analyze opcode and API names in fewer dimensions and to made an evaluation of malware detection and differentiation. Experimental results show that the time for learning was about 10 min faster and the performance was improved by about 0.5% compared to the One-Hot encoding method when Word2 Vec was used.  
[PERSON] et al. [45] considered that consecutive repetitive API calls were unnecessary, so the same APIs that appeared more than twice in a row in the collected API sequences were culled, and the API sequences were sorted according to the process call time to extract the valid API sequences. Then, each API call is transformed into a unique binary vector using Word2 Vec, and here they set the vector length to 50. Finally, by comparing the detection accuracy of GRU, BGRU, LSTM, BLSTM, and SimpleRNN, the highest accuracy of malware detection is determined by using BLSTM neural network. [PERSON] and [PERSON] [31] used a Markov chain approach to the detection of malware. The semantic similarity of each API in benign and malicious software was calculated in the initialization phase, and the APIs were clustered using K-means. After setting the API to its cluster index, a sequence of transfer matrices was constructed. They determined whether the sequence was malicious by calculating the API sequence's transfer probability. [PERSON] et al. [32] presented a SIMPLE model to identify novel malware families with limited samples, which significantly solved the problems of sample scarcity and dynamic identification. They took the original API sequence using N-gram to enhance the local feature representation, and word embedding was applied to initialize the embedding matrix.  
It is known from previous work that word vectors generated by malware can be used for malware detection, thus providing crucial insights for malware analysis. As far as we know, most deep learning-based malware detection methods work with static features, and only a few studies consider dynamic features. Moreover, most existing dynamic analysis methods only analyze a single feature or analyze the feature insufficiently, resulting in information loss and affecting accuracy. Therefore, our approach exploits CNNs using dynamic features to discover malware. Experimental findings demonstrate that the proposed detection method based on CNNs-BiGRU can efficiently detect malware.