# Malware API Calls Detection Using Hybrid Logistic Regression and RNN Model
## 3 Proposed Model
### API Call Sequences  
The application programming interface (API) is a critical element of the Windows operating system, encompassing an array of functions housed within specific libraries. Users leverage these functions to interact with the operating system, which in turn mirrors the behavior of various files. Therefore, it is of utmost importance to analyze the manner in which these calls are executed, to determine their authenticity [18]. In order to pinpoint malware, a multitude of API sequences are extracted from malware samples, which then serve as features for detecting the presence of malware [19].  
\begin{table}
\begin{tabular}{c c c c} \hline \hline
**Reference** & **Method** & **Classifier** & **\# of Malware** & **Accuracy** \\ \hline [PERSON] et al., 2019 [12] & Dynamic analysis & Long Short Term Memory (LSTM) & 12,000 & 0.973 \\ [PERSON] et al., 2019 [13] & Dynamic analysis & Deep Graph Convolutional Neural Networks (DGCNNs) & 42,797 & 0.924 \\ [PERSON], et al., 2019 [14] & Both static and dynamic analysis & Convolutional Neural Networks CNN & 118,717 & 0.93 \\ [PERSON] et al., 2020 [15] & Dynamic analysis & Random Forest machine learning model & 1909 & 0.973 \\ [PERSON], [PERSON] et al., 2022 [16] & Both static and dynamic analysis & Malware feature image convolutional neural network (MimgNN) & - & 0.97 \\ [PERSON], [PERSON], 2022 [17] & Both static and dynamic analysis & Multifaceted Deep Generative Adversarial & 5546 & 0.962 \\ \hline \hline \end{tabular}
\end{table}
Table 1: Comparison of Previous Research.  
For example, a significant portion of malware infects a victim's machine through Windows dynamic-link libraries (DLLs), which are libraries containing code and data that multiple programs can simultaneously access via API calls. The DLL injection sequence commences with an OpenProcess call to manage the targeted process, followed by allocating memory space using the VirtualAllocateEx call. Subsequently, the malware's complete path is written using WriteProcessMemory, and finally, the targeted process reloads the DLL through CreateRemoteThread. This sequence is extracted from the malware sample for further analysis.  
Another example involves import address table (IAT) hooking, where the IAT is a table populated with function pointers that are executed at runtime. In simpler terms, the IAT contains the starting addresses for APIs. By altering the addresses within the table, a different API can be called, resulting in malware behavior, as demonstrated in [20]. Figure 1 illustrates a simple IAT hooking technique, where the application code calls the Function1 API. Using the strcmp(0 function, the addresses stored in the import address table (IAT) are sequentially compared to find the correct address pointing to the required DLL function. Once the memory address containing the required DLL is located, the VirtualProtect() function is used to change the memory protection permissions, to allow writing and injecting the addresses, so that it can be redirected to the infected Baddll function rather than the required Function1.  
The model proposed in this study was trained on a secondary dataset containing samples of malware API call sequences, enabling it to detect unknown malware instances [21].