# Research on the Construction of Malware Variant Datasets and Their Detection Method
## 7 Conclusions  
To address the impact of various malware obfuscation techniques on malware detection, in this paper, we first constructed a dataset of unobfuscated and obfuscated malware variants, as well as their API sequences. Then, we proposed a malware detection method based on BERT and TextCNN. Finally, an experimental evaluation on the proposed method was made. Specifically, a real and operable malware variant dataset was constructed by binary rewriting first. Then, the original malware and variant malware were placed in the sandbox, and their API call sequences were dynamically extracted to construct the API sequence dataset with and without obfuscation. After that, BERT's pretrained model was trained through a public malware API call sequence dataset. By combining BERT and TextCNN, a new malware detection method was used to perform malware classification. Finally, to improve the malware detection accuracy under obfuscation, adversarial training techniques were adopted in the proposed malware detection schema. The experimental results show that the malware variant with obfuscation constructed in this paper can reduce the classification accuracy of traditional malware detection methods. Meanwhile, the proposed BERT-TextCNN-based malware detection methods combined with adversarial training can eliminate the impact of obfuscation. There are still many deficiencies in this paper. The input feature information currently considered is only the API sequence part, which is relatively simple. Considering that the parameters, timestamp, API category, call times and other information passed during API call are also important features, we have considered combining these features into our next detection scheme. In addition, FGM computes adversarial interference directly by parameter \(\epsilon\), which may not be the best way to generate adversarial samples. Therefore, \begin{table}
\begin{tabular}{c c c c c c c} \hline \hline
**Method** & **Normal** & **Downloader** & **Backdoor** & **Keylogger** & **Grayware** & **Average** \\ \hline Adversarial training & 0.93 & 0.78 & 0.86 & 0.89 & 0.82 & 0.856 \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Effect of BERT-TextCNN joining adversarial training. \begin{table}
\begin{tabular}{c c c c c c c} \hline \hline
**Method** & **Normal** & **Downloader** & **Backdoor** & **Keylogger** & **Grayware** & **Average** \\ \hline Random forest & 0.93 & 0.76 & 0.86 & 0.86 & 0.78 & 0.838 \\ CNN & 0.92 & 0.76 & 0.83 & 0.86 & 0.79 & 0.832 \\ LSTM & 0.92 & 0.77 & 0.83 & 0.87 & 0.74 & 0.826 \\ BERT & 0.93 & 0.78 & 0.84 & 0.87 & 0.80 & 0.844 \\ \hline \hline \end{tabular}
\end{table} 
Table 3: Classification effect of the obfuscated dataset. a better method for adversarial sample generation needs to be developed in the future. Finally, the method of slicing API call sequences in this paper also needs to be optimized. For example, one may slice the API sequences using the method of concept drift detection in the process mining field [35]. Conceptualization, F.L. ; methodology, F.L. ; software, Z.C. ; validation, Z.C. and M.T. ; formal analysis, Z.L. ; investigation, Z.C. ; resources, Z.C. ; data curation, Z.L. ; writing--original draft preparation, Z.C. ; writing--review and editing, Y.B. ; visualization, Z.C. ; supervision, F.L. and Y.B. ; project administration, F.L. ; funding acquisition, F.L. All authors have read and agreed to the published version of the manuscript. Not applicable. The raw virus data collected in this study are available at [[https://virusshare.com/](https://virusshare.com/)]([https://virusshare.com/](https://virusshare.com/)) (accessed on 19 June 2022). Virus API sequence datasets are available at [[https://github.com/ocatak/malware_api_class](https://github.com/ocatak/malware_api_class)]([https://github.com/ocatak/malware_api_class](https://github.com/ocatak/malware_api_class)) (accessed on 19 June 2022).