## 3 Background
### Dataset  
The dataset employed in this project encompasses a collection of Windows executable files. These executables underwent analysis within the Buster Sandbox Analyzer, leading to the extraction of API logs that the malware invoked during execution. In total, 782 samples were extracted from the initial raw dataset, subsequently divided into two distinct sets. One set consisted of approximately 583 samples categorized by types, while the other, comprising about 492 samples, was categorized by families. These datasets serve as the foundation for the experiments detailed in the forthcoming sections. For the category classification, the 583 samples were segregated into 11 distinct malware categories. The distribution of sample counts for each of these categories within the dataset is provided in Table 1. Additionally, in the case of family classification, the samples were classified into seven malware families. The corresponding sample counts for each of these families within the dataset can be found in Table 2.  
Each entry in the dataset comprises an API call log sequence corresponding to a specific malware instance. These logs generally contain the API name alongside supplementary details like file paths. To streamline the information, we preprocessed these files to retain solely the API call names. Consequently, for each sample, we processed a sequence of API calls executed during its runtime. The aggregate count of unique API calls encountered across the datasets tallies up to 94. Although employing the complete array of calls could yield valuable insights, it would entail extensive processing time when generating embeddings. Thus, it becomes pivotal to cherry-pick the most pertinent or crucial calls. The importance of an individual API call is determined by how frequently it appears in the dataset. In our experiments, we emphasized the most commonly occurring calls--the top 20 and top 40--which created two distinct groups of features. The percentage of total calls covered by these feature sets in relation to the entire range of calls is detailed in Table 3. Remarkably, even when focusing exclusively on the top 40 calls, we managed to capture  
\begin{table}
\begin{tabular}{c c} \hline \hline
**Malware Category** & **Sample Count** \\ \hline Adware & 50 \\ Backdoor & 53 \\ Modifier & 52 \\ PWS & 50 \\ Rogue & 53 \\ Tool & 60 \\ Trojan & 53 \\ Trojan Downloader & 52 \\ Trojan Monitoring Service & 53 \\ Virus & 55 \\ Worm & 52 \\ \hline \hline \end{tabular}
\end{table}
Table 1: Number of samples for each malware category.  
\begin{table}
\begin{tabular}{c c} \hline \hline
**Malware Family** & **Sample Count** \\ \hline Adload & 70 \\ Bancos & 71 \\ Onlinegames & 70 \\ VBInject & 70 \\ Vundo & 71 \\ Winwebsec & 70 \\ Zwangi & 70 \\ \hline \hline \end{tabular}
\end{table}
Table 2: Number of samples for each malware family.  
over 99% of the entire set of calls. Conducting experiments with the complete API call values did not result in enhanced performance. As a result, we chose to present only the experiments involving these two sets of percentage distributions.  
In both the cases of families and categories, we observed that the same API call (VirtualAllocEx) had the highest frequency.