# A Malware Detection Framework Based on Semantic Information of Behavioral Features
## 1 Introduction  
A boom in computers and Internet technology has given rise to a growing amount of malware being developed. According to AV-TEST statistics ([[https://portal.av-atlas.org](https://portal.av-atlas.org)]([https://portal.av-atlas.org](https://portal.av-atlas.org)), accessed on 11 January 2022), over 120 million new malware samples were identified in 2021, a 36.5% surge from the previous year. As of 2022, the total amount of malware had reached a billion, and the quantity of new malware was growing and accelerating year by year, which made the network security situation more and more severe. In today's era, the construction of new infrastructure, such as artificial intelligence, 5G networks, and industrial Internet, has gradually become a hot spot for innovation ([PERSON] et al. [1]; [PERSON] et al. [2]). Therefore, malware detection, especially for new variants that emerge, is essential in system and network security to prevent further threats to users ([PERSON] et al. [3], [PERSON] et al. [4]; [PERSON] et al. [5]). The mainstream approach to detecting malware is divided into two main categories: static analysis, which analyzes the program directly, and dynamic analysis, which requires running the program before starting the analysis ([PERSON] et al. [6]; [PERSON] et al. [7]). Static analysis methods usually refer to identifying malicious samples by examining the architecture or bytecode files of the program without running them ([PERSON] et al. [8]; [PERSON] et al. [9]). Normally, static analysis requires tools like IDA Pro and Stud_PE to extract static features, such as byte or opcode sequences, string information, etc. The characteristics obtained by static analysis can be compared with existing signatures saved in the database with malicious intent ([PERSON] et al. [10]; [PERSON] et al. [11]) or by machine learning models. However, those approaches can easily bypass fuzzing techniques ([PERSON] et al. [12]; [PERSON] et al. [13]) and are susceptible to interference in packing and deformation, leading to a decrease in accuracy. In addition, pattern matching methods can effectively and accurately detect known malware. However, they require a lot of manual experience for sample analysis and rule extraction, and require continuous updating of the signature database, which greatly limits the ability to detect new malware. An approach to dynamic analysis uses data on the behavior of malware throughout its execution to address the shortcomings of static analysis. Dynamic analysis methods obtain behavior characteristics like file, network, registry, and process activities by running examples in a secure virtual environment known as a sandbox, which can capture some attributes that reflect behavioral intent. Those approaches can be used to identify similarities in the dynamic behavior of undiscovered malware ([PERSON] et al. [14]). Therefore, it enables unknown malware detection, which is a capability that signature based approaches lack. Several studies ([PERSON] et al. [15]; [PERSON] et al. [16]; [PERSON] et al. [17]) have demonstrated in recent years that dynamic analysis can provide greater insight into how malware is generated and implemented than static analysis ([PERSON] et al. [18]; [PERSON] et al. [19]), and to a certain extent, can provide more reliable detection performance and is more resilient. Behavioral features, especially Application Programming Interface (API) call sequences, can hold relevant information about programs and behaviors, because it offers access information to the primary resources in the kernel system. A large number of researchers have extracted patterns in API call sequences for malware detection and classification. Some research attempts to identify malware by association rule mining ([PERSON] et al. [7]; [PERSON] et al. [20]; [PERSON] et al. [21]). However, with the growing quantity of malware and the emergence of new types of malware in recent eras ([PERSON] et al. [22]; [PERSON] et al.