## 2 Related Work  
Malware classification is among some of the most researched problems because of its global impact, and as such, several machine learning techniques have been identified to try to solve this problem. Within them, a common methodology is to study how the malware interacts with a system and extract features from it which could be helpful in understanding its behavior. These features may include a number of things such as opcodes, register changes, file system changes, API calls made, and so on. These features can be extracted using static analysis or dynamic analysis of the malware executable. Several studies have used API call logs as features to detect or classify malware, and they have achieved good results. In fact, malware under execution may cause the system to make different API calls, and these are good features for machine learning as they are usually used in a specific way. To extract these calls, we need to run the malware executable, which often requires a virtual environment [5]. The authors in [6] proposed a method for selecting a subset of API calls and achieved 0.98 accuracy in malware classification using algorithms like SVM and Random Forest. In a similar scheme, the authors in [7] proposed enhancing the API call information using Term Frequency and Inverse document frequency (TF-IDF) to select only the most important calls for malware detection, achieving near-perfect accuracy. These results provide enough evidence to argue for the effectiveness of API calls as a feature. While algorithms like SVM and Random Forest generally perform well at classification tasks, recent works have shown that techniques using deep neural networks can be successfully used because of their ability to uncover and learn complex relationships. In [8], the authors proposed a CNN-based architecture where they converted malware binaries to images, recording an impressive 98% accuracy. In [9], the authors discuss data mining techniques to select features and classify them using models like kNN and Naive Bayes. The selection of appropriate techniques to enhance the relevance of information in the features can be crucial in classifying malware. Word embeddings are learned representations of text that are used in natural language processing (NLP). Since their advent, they have been employed in a number of varied tasks with very promising results. Among these, malware classification has also emerged as a field where these techniques prove useful. This statement is supported by the work carried out in [10], where API call sequences are converted to numeric vectors using various methods. Another popular algorithm used to generate these representations is Word2 Vec, developed at Google [11]. In [12], the author uses Word2 Vec to extract vectors from machine code instructions and demonstrates the algorithm's ability in tasks of malware detection. Hidden Markov Models (HMMs) have found an effective use case in malware analysis because of their ability to determine patterns in sequences that are generally not directly observable. Several research works have tried modeling HMMs on various malware features and have shown promising results. In [13], the authors conduct a comparison between the efficacy of opcode sequences and API call sequences by training HMMs on them and conclude that the latter performs better. In a similar study [14], the authors also use HMMs and reach a similar conclusion. They argue that while opcodes are generally good, they fail to predict some families due to obfuscation techniques that are likely to affect them more than API calls. In [15], the author uses HMM2 Vec, a technique for generating vectors using HMMs opcodes as features. The work compares the performance of HMM2 Vec with Word2 Vec and delivers promising results with an accuracy of about 93% in both cases, thereby validating the HMM2 Vec approach. One drawback of the Word2 Vec algorithm is the inability to produce vectors that have contextual information.