## 1 Introduction  
Malware, or malicious software, is crafted to infiltrate computers and mobile devices, aiming to manipulate authoritative systems, gather sensitive information, display unwanted ads, or extort users [1; 2]. The surge in smart devices like laptops and phones has greatly expanded the threat landscape, jeopardizing user security and system integrity [3; 4]. Malware classification assigns specific labels to identify its family, which is a crucial step in addressing security challenges [5]. Malware classification can be divided into signature-based, machine learning-based, and deep learning-based methods in the method view or static analysis and dynamic analysis in the feature view. Signature-based approaches may encounter challenges when dealing with the rapid evolution of malware [6]. In response, traditional machine learning methods, including Support Vector Machines (SVM), Random Forests (RF), and Naive Bayes (NB), have been utilized for malware detection and classification [7; 8]. However, these approaches necessitate the manual extraction of features, relying on expert knowledge, which can introduce complexity to the process. Contemporary malware classification methods effectively leverage malware features, encompassing both static and dynamic attributes, to build machine learning or deep learning models. Static analysis involves the extraction of features as hex values and opcodes [9] from malware binary executable files through reverse engineering and examination of the original binary code. While static analysis is efficient, it is susceptible to evasion and obfuscation techniques. In contrast, dynamic analysis techniques capture malware behaviors, including file access, API (Application Programming Interface) calls, data flow, and other behavior traces, by executing and monitoring malware within a virtual sandbox. Dynamic analysis offers a more accurate representation of malware's actual objectives and actions, resulting in lower false-positive rates and higher accuracy [10, 11]. Combined with deep learning's image representation, many research works would treat the malware as an image by converting the feature from static and dynamic analysis into a matrix [12, 13]. Despite the success of feature analysis and deep learning, especially in image representation, we posit that API call sequences can be regarded as a form of language through which programs establish communication with operating systems, analogous to how individuals employ languages for interpersonal interaction, which can better reflect the nature of the malware. [PERSON] et al. point out that every type of malware has its own specific API call patterns or unique order of API calls [14]. In contrast to dynamic instruction features, the extraction of API call features necessitates only a coarse-grained dynamic analysis. Consequently, this approach incurs a relatively modest computational cost, rendering it highly effective for a broad spectrum of software codes. In this work, we propose a Two-step Training Dual Attention Transformer (TTDAT) using API call sequences for malware classification that takes the API call sequence as input and outputs its corresponding category. We employ local attention with an original encoder to form a dual Transformer to capture global and local information. To facilitate the efficient expansion of new categories of malicious code with minimal computational overhead and without the necessity of retraining the entire model, we design a two-step training strategy and transform the multi-classification problem into a classification mapping problem. During the training phase, the matching model is tasked with learning a scoring mechanism that quantifies the likelihood of an API call sequence belonging to a particular category. Subsequently, during the inference stage, we select the category with the highest score from the pool of candidate categories.