# A Malware Detection Framework Based on Semantic Information of Behavioral Features
## 1 Introduction
[23]), the traditional approach to high-volume malware detection consumes a lot of human and computing resources and limits detection efficiency. Thus, more and more researchers are focusing on Machine Learning and Deep Learning. Some studies, for instance, have extracted characteristics from sequences of API calls and used Machine Learning algorithms that include Random Forests, K-Nearest Neighbors, and Support Vector Machines ([PERSON] et al. [24]; [PERSON] et al. [25]; [PERSON] et al. [26]), and Deep Learning algorithms, like Convolutional Neural Networks ([PERSON] et al. [27]; [PERSON] et al. [28]; [PERSON] et al. [29]) for malware detection. Deep learning algorithms have the advantage of being faster and more accurate than Machine Learning methods in automatically extracting malware features for detection, dramatically improving detection efficiency and increasing detection accuracy while promoting the development of malware detection technology. Moreover, inspired by the Natural Language Processing (NLP) techniques, which are also applied to detect malware ([PERSON] et al. [30]; [PERSON] et al. [31]; [PERSON] et al. [32]), programs can be understood by the sequence of API calls representing the context of the calling program. Although there are many studies based on natural language processing, there are still some problems. For example, most studies only analyze semantic information and ignore the analysis of structural and statistical features. In this paper, we propose an approach to detect malware with natural language processing and behavioral features, which uses word embedding techniques and feature weighting to learn the the characteristic patterns of API calls in malware. The API sequence feature that describes the context relationship between consecutive API calls and the name feature modeled according to the API name semantic structure information and statistical features. We implement the approach with a deep neural network, namely CNNs-BiGRU. Results illustrate that our proposed work better than other machine learning and deep learning models, achieving an accuracy of 0.9828 and an F1-Score of 0.9827 on the test set. In summary, the following contributions are given in this paper. * We propose an approach to malware detection that is based on natural language processing and behavioral features, which can achieve high accuracy just by analyzing API call sequences;
* We design a feature vectorization representation method based on the Skip-Gram algorithm for better learning of contextual behavior information. We demonstrate the results of the experiments and validate the experimental effect of the feature method for word vector representation;
* We design a method that combines API calls' semantic information and statistical characteristics. Numerous experiments verify the effectiveness of the approach we propose;
* We propose a CNNs-BiGRU based deep learning approach to implement malware detection and evaluate it. The results demonstrate that our model superior to other malware detection models. The rest of this article is organized as follows: Existing research works related to malware detection is discussed in Section 2. Section 3 delineates the proposed approach. Section 4 gives the datasets and the obtained empirical results. Section 5 concludes this article and analyzes the limitations of this framework and future work.