## 3 Theoretical Background
### Graph Node Embedding
#### 3.2.1 Node2 Vec  
Node2 Vec is an algorithm that converts graph nodes into vectors (embedding) [27]. These vectors represent the structural features of the graph (topology) and the relationships between nodes. Node2 Vec performs random walks on the graph starting from a certain node. During these walks, the context of the nodes is determined. Node sequences created by random walks are treated as word sequences, and embeddings are created using Word2 Vec. In practice, a walk length of 30 and 200 walks per node, and 128-dimensional embeddings based on experimental validation were used. Algorithm 1 shows the pseudocode of the Node2 Vec algorithm. ```
0: Graph \(G=(V,E)\), embedding dimension \(d\), walk length \(l\), walks per node \(r\), context window size \(k\), return parameter \(p\), in-out parameter \(q\)
0: Feature representations \(f\)
1: Compute transition probabilities \(\pi\) using parameters \(p\) and \(q\)
2: Create weighted graph \(G^{\prime}=(V,E,\pi)\)
3: Initialize list all_walks as empty
4:for each node \(u\in V\)do
5:for\(i=1\) to \(r\)do
6:\(walk\leftarrow\textsc{RandomWalk}(G^{\prime},u,l)\)
7: Append walk to all_walks
8:endfor
9:endfor
10: Train Skip-Gram model on all_walks using context window size \(k\) to obtain embeddings \(f\)
11:return\(f\)
12:functionRandomWalk(\(G^{\prime},start\_nodeu,length\))
13: Initialize walk \(\leftarrow[start\_node]\)
14:while length of walk \(<l\)do
15:\(curr\_node\leftarrow\) last node in walk
16:\(neighbors\leftarrow\textsc{GetNeighbors}(curr\_node,G^{\prime})\)\(>\) GetNeighbors, returns the set of neighboring nodes directly connected to the given node in the graph \(G\). 17:\(next\_node\leftarrow\textsc{AliasSample}(neighbors,\pi)\)\(\triangleright\) The AliasSample, samples the next node among neighbors according to their pre-calculated transition probabilities. 18: Append \(next\_node\) to walk
19:endwhile
20:return walk
21:endfunction
```  
**Algorithm 1** Node2 Vec Random Walk and Embedding Learning  
#### 3.2.1 Node2 Vec  
Node2 Vec is an algorithm that converts graph nodes into vectors (embedding) [27]. These vectors represent the structural features of the graph (topology) and the relationships between nodes. Node2 Vec performs random walks on the graph starting from a certain node. During these walks, the context of the nodes is determined. Node sequences created by random walks are treated as word sequences, and embeddings are created using Word2 Vec. In practice, a walk length of 30 and 200 walks per node, and 128-dimensional embeddings based on experimental validation were used. Algorithm 1 shows the pseudocode of the Node2 Vec algorithm. ```
0: Graph \(G=(V,E)\), embedding dimension \(d\), walk length \(l\), walks per node \(r\), context window size \(k\), return parameter \(p\), in-out parameter \(q\)
0: Feature representations \(f\)
1: Compute transition probabilities \(\pi\) using parameters \(p\) and \(q\)
2: Create weighted graph \(G^{\prime}=(V,E,\pi)\)
3: Initialize list all_walks as empty
4:for each node \(u\in V\)do
5:for\(i=1\) to \(r\)do
6:\(walk\leftarrow\textsc{RandomWalk}(G^{\prime},u,l)\)
7: Append walk to all_walks
8:endfor
9:endfor
10: Train Skip-Gram model on all_walks using context window size \(k\) to obtain embeddings \(f\)
11:return\(f\)
12:functionRandomWalk(\(G^{\prime},start\_nodeu,length\))
13: Initialize walk \(\leftarrow[start\_node]\)
14:while length of walk \(<l\)do
15:\(curr\_node\leftarrow\) last node in walk
16:\(neighbors\leftarrow\textsc{GetNeighbors}(curr\_node,G^{\prime})\)\(>\) GetNeighbors, returns the set of neighboring nodes directly connected to the given node in the graph \(G\). 17:\(next\_node\leftarrow\textsc{AliasSample}(neighbors,\pi)\)\(\triangleright\) The AliasSample, samples the next node among neighbors according to their pre-calculated transition probabilities. 18: Append \(next\_node\) to walk
19:endwhile
20:return walk
21:endfunction
```  
**Algorithm 2** Node2 Vec Random Walk and Embedding Learning  
Figure 1: Directed graph representation of API call sequences extracted from a malware sample.