## 5 Conclusions  
In this study, we conducted an array of experiments to assess the efficacy of utilizing API call information as a feature for both malware category and family classification. Our approach involved testing hybrid machine learning techniques, wherein diverse word embedding methods were combined to engineer features. We evaluated the performance of four distinct embedding techniques--Hmm2 Vec, Word2 Vec, ELMo, and BERT--paired with four classifiers, namely SVM, RF, kNN, and CNN. The results of our experiments unequivocally demonstrate Word2 Vec's superior performance, achieving the highest accuracy of 0.93 for family classification and 0.77 for category classification. However, Word2 Vec's training time was relatively shorter compared to other techniques. Interestingly, BERT's performance did not surpass Word2 Vec, which was somewhat anticipated. This might be attributed to the dataset size. BERT necessitates a substantial training dataset to grasp meaningful relationships, implying that an increase in sample size could potentially lead to improved performance. Another potential factor is the input length limitation of 512 tokens in BERT, where we employ the initial 512 tokens in our sequences. Given the length of some sequences, we could be losing crucial information. Utilizing alternate token selections, such as the last 512 tokens or a custom approach, might yield better outcomes. Across classifiers, a consistent trend emerged: Random Forest consistently outperformed other classifiers. Our documented outcomes underscore the valuable potential of API calls as a robust feature for effective malware classification. Figure 7: Comparison of hybrid machine learning approaches for malware family. For future work, the scope of the experiments conducted herein can be extended to encompass a broader range of malware categories and families. Exploring analogous experiments with alternate features, such as byte n-grams or combinations thereof, could yield promising results. In addition, ensemble learning could be tested to understand its benefit with these specific types of data. Also, additional study on the effect of obfuscation techniques on the embeddings could be an interesting follow-up to this work. While this research relied on frequency-based feature selection, techniques like TF-IDF [7] and Fisher score [30] have shown efficacy in similar tasks, and employing them could enhance scores, especially for HMM2 Vec, by eliminating irrelevant features. Furthermore, an exploration into other embedding methods is warranted. GPT-based models, which have gained substantial traction, merit investigation to gauge their performance against the techniques assessed in this study. Conceptualization, F.D.T. ; methodology, F.D.T. ; software, S.A.; validation, F.D.T. ; formal analysis, F.D.T. ; investigation, F.D.T. ; resources, S.A.; data curation, F.D.T. ; writing--original draft preparation, S.A.; writing--review and editing, F.D.T. ; visualization, F.D.T. ; supervision, F.D.T. All authors have read and agreed to the published version of the manuscript. This research received no external funding. The dataset used in this article can be found at [[https://drive.google.com/drive/folders/1](https://drive.google.com/drive/folders/1) eDv1 gSO-RUjlliZobprOyofINMy65 Oe4?usp=sharing]([https://drive.google.com/drive/folders/1](https://drive.google.com/drive/folders/1) eDv1 gSO-RUjlliZobprOyofINMy65 Oe4?usp=sharing) (accessed on 25 June 2024). The authors declare no conflicts of interest. Figure A2: Confusion matrix for HMMZVec-KNN category classification. Figure A4: Training model accuracy vs. loss for Hmm2 Vec-CNN for category. Figure A6: Confusion matrix for Word2 Vec-KNN category classification. Figure A9: Confusion matrix for ELMo-SVM category classification. Figure 10: Confusion matrix for ELMo-CNN category classification. Figure 13: Confusion matrix for BERT-SVM category classification. Figure 14: Confusion matrix for BERT-KNN category classification. Figure 15: Confusion matrix for BERT-CNN category classification.