# Malware API Calls Detection Using Hybrid Logistic Regression and RNN Model
## 3 Proposed Model
### Hybrid Model  
Weight initialization in neural networks is a difficult task, specifically in iterative neural network algorithms, where the initial point can determine if the algorithm will converge or not and also affect result generalization [22]. For this reason, we need to initialize the NN weights carefully. Our proposed model, as shown in Figure 1, is designed to initialize neural network weights using logistic regression weights. The logistic regression model is a supervised learning technique that is used in binary classification.The logistic regression can be defined as in Equation (1):  
\[y=\frac{e^{(wx+b)}}{1+e^{(wx+b)}} \tag{1}\]  
While logistic regression has its limitations for capturing non-linear associations, leveraging it as a source of initial weights for a neural network yields numerous advantages. The proposed hybrid model, which fuses logistic regression and neural networks, seeks to  
Figure 1: IAT hooking. enhance malware detection performance based on API calls by utilizing their combined strengths. Employing logistic regression in this manner allows the model to capitalize on its ability to identify significant features and achieve faster convergence, while the neural network can model complex relationships within the data. Algorithm 1 demonstrates a collection of API call sequences, denoted as \(x\), which function as the input for the model. The output is a binary classification label, \(y\), that signifies whether the input sequence is malware or not. To develop a coherent model, the input sequences x and their corresponding labels \(y\) are employed to train a logistic regression model. This process involves utilizing the training data to compute the logistic regression model's coefficients, represented as \(\theta\). The input and output sizes must be defined to initialize the RNN. Following this, the coefficients from the logistic regression model are transposed to serve as the RNN's input-to-hidden weights, denoted as \(W_{x}\). The training data, a given loss function, an optimizer, and a specified number of epochs, were then used to train the RNN. Lastly, the performance of the trained RNN was assessed by applying a specific evaluation metric on a separate test dataset. ```
Input: API call sequences \(x\). Output:\(y\) that classify if \(x\) malware or not malware
1:\(\theta\leftarrow TrainLogisticRegression(x,y).coefficient()\)
2:\(rnn\gets InitializeRNN(InputSize,OutputSize)\)
3:\(Wx=Transpose(\theta)\)
4:\(SetWeights(rnn.InputToHiddenWeights,Wx)\)
5:\(TrainRun(rnn,\)\(TrainingData,\)\(Activation,\)\(LossFunction,\)\(Optimizer,\)\(NumEpochs)\)
6:\(TestRun(rnn,TestData,Evaluation)\)
7:end
```  
**Algorithm 1**Hybrid Model  
The result of logistic regression is a probability ranging from 0 to 1, indicating the likelihood of a given data point belonging to a particular class. Upon completing the model training, we achieved an accuracy of 0.82 with the balanced dataset and 0.98 with the imbalanced dataset. We then extracted the weights obtained during the final stage of the logistic regression training, to be utilized as initial weights in the neural network. A recurrent neural network (RNN) is a deep learning model that takes the sequence input to perform an operation on it and then produces either one or a sequence of outputs. Here, we used the many-to-one type of RNN, where the model takes many API calls and classify them into one class, either malware or not malware. In other words, we used a sequential model. The main advantage of this RNN model is that model can remember its previous inputs for computations. The RNN can be defined as shown in Equation (2) :  
\[h^{(t)}=f(h^{(t-1)},x^{t};\Theta) \tag{2}\]  
In the end, after developing the proposed model, we evaluated its effectiveness. We compared the model's performance on both balanced and imbalanced datasets, as illustrated in Figure 2. Through this evaluation, we sought to gain insights into how well the proposed model could be generalized to different types of dataset.