## 5 Conclusions  
In this research, we showed that malware detection is possible using static and dynamic methods. In this paper, we proposed a method to classify malware based on an API call that reflects the behavior of a piece of malicious code. Furthermore, we introduced a method to construct features based on API sequence from the result of the static and dynamic analysis. Furthermore, the extracted features were correctly assigned by a computation of similarity-based machine learning algorithms and statistics methods to profile and classify the program files as benign or malware. Finally, the experimental results of the similarity analysis of malware based on API call and the frequency of appearance of executable files reveal that this technique is effective in the detection and classification malware even if obfuscation methods are applied on the malware. For future work, we plan to perform research on Windows 8 and 10 as these are the latest Operating Systems of Microsoft Windows. We also plan to target where to apply our research, such as Financial Institutions as they are more targeted by malware makers. Our main goal is to conduct research on malware and their variants that are specific to banks.  
Design, Concept, and First Version Article, B.N.; Experiment and Implementation K.H.K.; Data Analysis and Report Generation Y.J.K.; Code Review, Second Version Article and Compilation H.H.K.; Supervision, Project Manager T.Y.K.; Funding Acquisition, Investigation, Resources, H.J.L. This research received no external funding. This work was supported by Institute for Information and Communications Technology Promotion (IITP) grant funded by the Korea government (MSIT) (2018-0-00285, Development of HD video data and control (signal Endecryption processing high confidence dual core SoC management system for Unmanned Vehicle) & (No. 2018-0-00245, Development of prevention technology against AI dysfunction induced by deception attack). The authors declare no conflict of interest.  
\begin{table}
\begin{tabular}{c c c c c c c c c} \hline \hline
**Features** & **.jalr** & **.btz** & **.syscall** & **.fprem** & **.mrob** & **.ivtl** & **.usere** & **.srvbw** \\ \hline
**.jalr** & 0.00 & 0.21 & 0.00 & 0.17 & 1.00 & 1.00 & **0.23** & **0.23** \\
**.btz** & 0.25 & 0.00 & 0.21 & 0.05 & 1.00 & 1.00 & **1.00** & **1.00** \\
**.syscall** & 0.21 & 0.15 & 0.00 & 1.00 & 1.00 & 1.00 & 1.00 & 0.09 \\
**.fprem** & 0.15 & 1.00 & 1.00 & 0.00 & 1.00 & 1.00 & 0.99 & 0.24 \\
**.mrob** & 0.21 & 1.00 & 1.00 & 1.00 & 0.00 & 1.00 & 0.07 \\
**.ivtl** & 1.00 & 0.98 & 0. & 1.00 & 1.00 & 0.00 & 1.00 & 1.00 \\
**.usere** & 1.00 & 0.28 & 0.11 & 0.18 & 1.00 & 1.00 & **0.00** & 0.05 \\
**.srvbw** & 1.00 & 0.18 & 0.11 & 0.18 & & & 0.05 & 0.00 \\ \hline \hline \end{tabular}
\end{table}
Table 6: Matrix of similarity for the DyFuCa virus.  
\begin{table}
\begin{tabular}{c|c c c c c c c c} \hline \hline
**Features** & **.texdt** & **.rdas** & **.rscf** & **.reloe** & **.kkng** & **.ipfi** & **.usere** & **.icon** \\ \hline
**.texdt** & 0.00 & 0.14 & 0.24 & 0.10 & 0.10 & 0.10 & 0.10 & 0.10 \\
**.rdas** & 0.10 & 0.00 & 0.12 & 0.00 & 0.12 & 0.12 & 0.11 & 0.23 \\
**.rscf** & 0.21 & 0.23 & 0.00 & 0.25 & 0.22 & 0.21 & 1.00 & 0.28 \\
**.reloe** & 0.13 & 0.00 & 0.22 & 0.00 & 0.23 & 0.00 & 0.25 & 0.23 \\
**.kkng** & 0.13 & 0.16 & 0.21 & 0.26 & 0.00 & 0.00 & 0.00 & 0.21 \\
**.ipfi** & 0.13 & 0.16 & 0.22 & 0.26 & 0.00 & 0.00 & 0.00 & 0.16 \\
**.usere** & 0.14 & 0.16 & 0.28 & 0.26 & 0.00 & 0.00 & 0.00 & 0.16 \\
**.icon** & 0.14 & 0.15 & 0.21 & 0.26 & 0.19 & 023 & 0.21 & 0.00 \\ \hline \hline \end{tabular}
\end{table}
Table 5: Similarity matrix of the Trojan: Win32/Banload.A family.