# Research on the Construction of Malware Variant Datasets and Their Detection Method
## 1 Introduction  
Malware is a malicious program that is harmful to a computer system. It attempts to invade, damage or disable computers, networks, tablets and mobile devices. The purpose is usually to steal, encrypt or delete data, alter or hijack computer core functions, monitor computer activity, or even damage computer hardware. With the rapid development of network technology, the automatic attack of large-scale malware has become the main form of network attack, which not only brings great trouble to ordinary users but also brings great losses to enterprises and government departments. For example, WannaCry [1], which began to erupt in 2017, caused a worldwide disaster. In August 2020, the weekly report on network security information and dynamics released by China's national Internet Emergency Center pointed out that the number of hosts infected with network malware in China had reached 586,000, approximately 527,000 hosts controlled by Trojans or zombies, and approximately 59,000 hosts infected with flying guest worms [2]. The overall amount of malware increased by 43.71% over the same period in 2019 [3], which made enterprises, governments and schools subject to complex and diverse threats. Generally, malware has symbolic signature features. Therefore, the signature-based malware detection method is the most widely used method in commercial anti-malware programs. However, such a method cannot detect emerging malware and its variants [4]. Attackers also attempt to limit the effectiveness of signature-based analysis by implementing techniques such as obfuscation and packing [5]. To solve this problem, malwaredetection technology based on supervised learning technology has been widely studied [6]. These methods can be divided into two categories: static detection and dynamic detection. The codes of the same malware family usually have a coding similarity. In view of the above similarities, static detection methods analyze the static features extracted from the binary files of malware and then detect malware by comparing the similarities and differences between the static features of malware and normal software. Generally, static methods usually detect malware based on opcode sequences [7], byte sequences [8], or the generated image features [9] of malware. For the detection method based on opcode sequences, the executable PE file can usually obtain the instruction sequence through disassembly and then classify and count the opcode of the instruction according to arithmetic operations, data operations, logical operations, etc., as the classification feature or use the n-gram method to divide the opcode as the classification feature [10]. For the detection method based on a byte sequence, the instruction sequence part of the opcode is usually taken out separately and transformed into digital features. On this basis, n-gram and other methods are used for classification [11]. The malware detection method based on image features regards every 8 bits of the malware byte sequence as a gray value. In this way, a 256-color gray image [12; 13] can be generated for the malware, or the gray image can be extracted by processing a variety of byte sequences, and then a three-channel color image [14] can be constructed through the gray image. Then, the classification methods based on image features such as convolutional neural networks are used to detect the malware. Dynamic malware detection methods mainly record the behavior characteristics of malware by executing malware samples in a virtual environment and determine whether it is malware through the analysis of behavior characteristics. The behavior information includes the behavior log, system call name, context parameters, environment variables, etc. The system API is the interface used to implement the operating system, and malware usually destroys the operating system by calling the system level API. Therefore, the mainstream dynamic detection scheme mainly identifies malware based on the system API call sequence of malware [15].