# Features Engineering to Differentiate between Malware and Legitimate Software
## 5 API Call Visualisation

Table 5: Comparative analysis with cutting-edge works (Balanced Data set). network models to detect malware. However, such solutions require high computation power and resources. Traditional classifiers such as RF require less time for training, and possess lower intrinsic complexity. The experimental results showed that RF performed quite similarly to state-of-the-art-deep learning techniques. This suggests a viable prospect of performing inference in a real-time setting using RF on edge devices. Using different data sets for similarity graphs with more goodware samples would be very interesting for future work. Additionally, testing the RF model on the condition of concept drift is another direction of future work. As an extension to this study, the next research will tackle the implementation scenarios of the RF model on edge devices. Conceptualization, A.Y.D. and A.A.-N.; data curation, A.Y.D. and A.K.N. ; formal analysis, A.Y.D. ; funding acquisition, J.C.; investigation, A.Y.D. ; methodology, A.Y.D., A.K.N. and A.A.-N.; project administration, A.A.-N. and J.C.; resources, A.Y.D. ; Software, A.Y.D. ; validation, A.Y.D. ; writing--original draft, A.Y.D. ; writing--review and editing, A.A.-N., A.K.N. and J.C. All authors have read and agreed to the published version of the manuscript. This research received no external funding. Not applicable. The authors declare no conflict of interest. ## References

* [1] [PERSON] [PERSON]; [PERSON]; [PERSON]; [PERSON] Ransomware-Resilient Self-Healing XML Documents. _Future Internet_**2022,** _14_, 115. [CrossRef]
* [2] [PERSON] Global Ransomware Damage Costs Predicted to Exceed 265 Billion by 2031. 2022. Available online: [[https://cybersecurityventures.com](https://cybersecurityventures.com)]([https://cybersecurityventures.com](https://cybersecurityventures.com)) (accessed on 27 November 2022). * [3] Institute, A.T. ATLAS Malware & PUA. 2022. Available online: [[https://portalav-atlas.org/malware](https://portalav-atlas.org/malware)]([https://portalav-atlas.org/malware](https://portalav-atlas.org/malware)) (accessed on 25 November 2022). * [4] [PERSON]; [PERSON] Malware Analysis and Detection Using Machine Learning Algorithms. _Symmetry_**2022,** _14_, 2304. [CrossRef]
* [5] [PERSON]; [PERSON]; [PERSON] Analyzing machine learning approaches for online malware detection in cloud. In Proceedings of the 2021 IEEE International Conference on Smart Computing (SMARTCOMP), IEEE, Irvine, CA, USA, 23-27 August 2021; pp. 189-196. * [6] [PERSON]; [PERSON] A benchmark API call dataset for windows PE malware classification. _arXiv_**2019**, arXiv:1905.01999. * [7] [PERSON]; [PERSON]; [PERSON] Malware behaviour analysis. _J. Comput. Virol._**2008,** \(4\), 279-287. [CrossRef]
* [8] [PERSON]; [PERSON]; [PERSON]; [PERSON]; [PERSON]; [PERSON]. Malware detection issues, challenges, and future directions: A survey. _Appl. Sci._**2022,** _12_, 8482. [CrossRef]
* [9] [PERSON]; [PERSON]; [PERSON]; [PERSON] Survey on edge computing security. In Proceedings of the 2020 International Conference on Big Data, Artificial Intelligence and Internet of Things Engineering (ICBAIE), IEEE, Fuzhou, China, 12-14 June 2020; pp. 96-105. * [10] [PERSON]; [PERSON] Review of machine learning methods for windows malware detection. In Proceedings of the 2019 10 th International Conference on Computing, Communication and Networking Technologies (ICCCNT), IEEE, Kanpur, India, 6-8 July 2019; pp. 1-6. * [11] [PERSON]; [PERSON] An ensemble-based malware detection model using minimum feature set. _Mendel_**2019,** _25_, 1-10. [CrossRef]
* [12] [PERSON]; [PERSON]; [PERSON]; [PERSON]; [PERSON] A feature-hybrid malware variants detection using CNN based opcode embedding and BPNN based API embedding. _Comput. Secur._**2019,** _84_, 376-392. [CrossRef]
* [13] [PERSON]; [PERSON]; [PERSON] Efficient and Robust Malware Detection Based on Control Flow Traces Using Deep Neural Networks. _Comput. Secur._**2022,** _122_, 102871.