# Research on the Construction of Malware Variant Datasets and Their Detection Method
## 3 Construction of the Malware Variant and Its API Call Sequence Dataset
### Construction of the Malware Variant API Call Sequence Dataset  
Section 3.1 constructed the executable PE file of malware and its variants. This section extracts its API call sequence, constructs an API call sequence set that can truly reflect the behavior of malware after obfuscation, and partially preprocesses the malware tag and sequence set. The extraction of API call sequences depends on automatic testing tools. Cuckoo Sandbox is an open-source automatic malware analysis system that can capture information such as the system API call and its parameter transmission and return value, network traffic data, memory usage records and so on. The overall process of building the API sequence dataset is shown in Figure 5. For a malware, in order to make its variant, the two malware were placed in the sandbox and their call sequences extracted to obtain an original malware API call sequence set and a variant malware API call sequence set. By comparing the classification effects of the two datasets, we could detect whether the variant had a certain interference ability with the classification and how to deal with the interference of the variant malware with the detection. Figure 4: The logic of the hook function. For the tag of malware, considering that the existing detection mechanisms are tags for static behavior and that there is no good tag mechanism for the behavior of malware, in this paper, we intended to use more information to construct the tag of malware. Specifically, based on the classification tags of AVClass2 [31], we further combined the information in the malware engine report to generate more accurate tags. AVClass2 was used to analyze the malware sample report of VirusTotal, which is divided into five categories as the multiclass classification labels of malware: normal, downloader, backdoor, keylogger and grayware. For the obfuscated variant malware, the corresponding original malware label is used as the variant malware label. In addition, in the API call sequence extracted by Cuckoo Sandbox, malware will often call the same API repeatedly. Some API calls are expected behavior. For example, WannaCry blackmail malware will repeatedly call the API to read and delete files, and some are unexpected behaviors. For example, exceptions are discarded during the execution of malware, read again and call the relevant API again. To counteract the problem of repeated calls on the dataset and enhance the generalization ability of the model, it was necessary to duplicate the repeated continuous API call sequence. Finally, since different malware performs different operations, and different operations take different lengths of time, the length of the API sequences we extracted from the different malware in the same time duration was usually different. The longest sequence can contain 30,000 API calls, while the shortest sequence contains only 50. For this problem, the authors of [24] only intercept the front part of the sequence for detection, which may omit the information related to the malicious behavior of malware because the sequence of relevant malicious behavior is not executed. Therefore, in this paper, we adopted a method of subsequence extraction. Every 200 API calls were extracted as a sequence. At the same time, to minimize the lack of semantics, the last 50 API calls of the previous sequence were taken as the first 50 API calls of the next sequence. The principle of dataset entry division is shown in Figure 6. Compared with the method of extracting the first N API calls, the method of constructing subsequences can detect as many sequences as possible to obtain a more complete detection effect. However, this also has some disadvantages because some of the obtained sequences may not have malicious behavior, which may lead to a reduction in detection accuracy. Figure 5: Extraction process of the malware variant API sequence dataset. Figure 6: Schematic diagram of API sequence dataset entry division.