## 4 Experiments and Results
### API Call Frequency and Sequence of Occurrence  
From static and dynamic analysis, we capture the API function from malware and benign files and it is expressed as API call sequence. Let V denote the dataset that contains M as malware, PE as portable executable files, and BF as benign files, \(\mathrm{V}=\left\{\mathrm{M},\mathrm{PE},\mathrm{BF}\right\}\). The frequency of every function is then computed in order to have the most significant API functions list. Let \(\mathrm{f}_{\mathrm{m}_{i}}=\left\{\mathrm{m}_{1},\mathrm{m}_{2},\mathrm{m}_{3 },\ldots,\mathrm{m}_{n}\right\}\) be the frequencies of functions in the M and \(\mathrm{f}_{\mathrm{P}_{i}}=\left\{\mathrm{p}_{1},\mathrm{p}_{2},\mathrm{p}_{3 },\ldots,\mathrm{p}_{n}\right\}\) be the frequencies in the PE, and \(\mathrm{f}_{\mathrm{b}_{i}}=\left\{\mathrm{b}_{1},\mathrm{b}_{2},\mathrm{b}_{3 },\ldots,\mathrm{b}_{n}\right\}\) frequencies in the BF. Finally, let us denote the API function as A. Algorithm 1 describes the main steps used in our method.  
\begin{table}
\begin{tabular}{c c c c} \hline \hline
**Type or Class** & **Quantity** & **Percentage** & **Maximum Size (KB)** \\ \hline Benign & 17,214 & 21.91 & 122,154 \\ Trojan & 16,146 & 20.55 & 18,547 \\ Virus & 19,821 & 25.23 & 784 \\ Worm & 13,541 & 17.23 & 16,000 \\ Rootkit & 357 & 0.45 & 789 \\ Backdoor & 8541 & 10.87 & 2054 \\ Flooder & 1424 & 1.81 & 39,785 \\ Exploit & 1524 & 1.94 & 29,431 \\ \hline \hline \end{tabular}
\end{table}
Table 2: Dataset of malware and benign used in our experiment.  
Figure 4: The main component of the experimental environment.  
**Definition 1**.: _For each API function **A**, from **M**, **PE**, and **BF** datasets, there is a frequency \(f\) for each \(A\) denoted \(m_{i}\in M;p_{i}\in PE\wedge b_{i}\in BF\) which measures the number of times that \(A\) occurs in \(V\) dataset. The computation of the frequencies is satisfied as follows:_  
\[f_{m_{i}}=\frac{\sum m_{i}}{\sum M} \tag{1}\]  
\[f_{p_{i}}=\frac{\sum p_{i}}{\sum PE} \tag{2}\]  
\[f_{b_{i}}=\frac{\sum b_{i}}{\sum BF} \tag{3}\]  
```
0:\(V=\{M,PE,BF\}\)
0:\(f=\{m_{i},p_{i},b_{i}\}\) // Set of frequencies representing all A occurrence in V
1. Run V in Win 7 // Static Analysis by IDA Pro and PEid
2. Create report from IDA Pro and PEid // Preliminary database about API Function List
3. Query on the preliminary DB
4. Verity if the database = **O** // Empty database
5. If yes, abort
6. Otherwise,
7. For each A in the database,
8. Compute\(f_{m_{i}},f_{p_{i}},f_{b_{i}}\)
9. Insert\((f_{m_{i}},f_{p_{i}},f_{b_{i}})\) to API Sequence
10. End for
11. Run V in Windows XP // Cuckoo Sandbox for dynamic analysis
12. Repeat 2 to 10
13. Duplicates removal: API_Sequence, Max_Length_Repeat
14. Database = API Sequence
15. Init: SeqIndex \(\gets 0\);
16. While true do:
17. If SeqIndex = Length_Sequence then
18. break;
19. Else
20. for i \(\gets 1\) to Max_Length_Repeat do
21. if found_repeat = true, then
22. break;
23. End
24. Found_repeat \(\leftarrow\) remove (API_Sequence, SeqIndex, i);
25. SeqIndex +=i; // Update the API Sequence Database
26. End
27. End
28. End
```  
**Algorithm 1**API Call List Frequency and Sequence--Computation Process