# A Malware Detection Framework Based on Semantic Information of Behavioral Features
## 3 Methodology
### CNNs-BiGRU Model  
We apply the CNNs-BiGRU model to build a malware detection model, which includes a deep learning architecture consisting of convolutional layers with multiple convolutional  
Figure 3: API embedded module. kernels of different sizes and bidirectional GRUs. Figure 4 shows a detailed description of the CNN-BiGRU layers used for malware detection. Input layer: This layer has malware or benign software samples for training and testing, it consists of a sample set of datasets with length varying between 0 and L as input. We select 80% of the dataset as training set in a randomized manner and keep the remaining 20% as test set with a data size of 20,000. The preprocessing block is a part of the input layer, where the length of the sequence of all the samples is uniformly processed. Here, it is set to a fixed length of 1000 to improve performance and reduce training time while maximizing the inclusion of useful data. Embedding layer: The embedding layer converts each call in the API sequence into a vector representation. We determine the embedding vectors based on the word vector model with semantic information of the API sequence and the feature vector model consisting of API name features processed into the Skip-Gram model in Section 3.2. The output dimensions of the embedded layers are 200 and 10 to represent API calls of malware or benign files, respectively. Convolution 1D layer: The convolution layer is the main building block of the CNN. We use multiple convolution kernels of different scales in parallel. Multi-layer convolution applies several convolution layers with different filter sizes to extract API calls of different lengths, where different lengths of sequences represent different granularity of behavioral features. The API sequence module sets up three parallel convolution layers with filter sizes of 3, 4, and 5, respectively, and the API name module applies an embedding layer and a convolution layer with filter size 4. The API name module applies an embedding layer and a convolutional layer with a filter size of 4. \"Relu\" is used as the activation function of the layer. Bidirectional GRU layer: after concatenating all the outputs of the convolutional layer, the BiGRU module is applied to process the data in both the forward and reverse directions to capture the relationship between the API calls. A gated recurrent neural network is a simplified and improved neural network for LSTM ([PERSON] et al. [54]). For the gated recurrent unit, in order to reduce the parameters and tensor of the model and improve the information processing efficiency, the gated recurrent unit will replace the three gating units of the LSTM with the Reset gate (\(r_{t}\)) and the Update gate (\(z_{t}\)); thus, it is more concise and efficient than LSTM. The gates are formalized as Formulas (5) and (6). The GRU unit is shown in Figure 5.  
Figure 4: CNNs-BiGRU model architecture. The GRU obtains the information of the two gates through a current input \(x_{t}\) and the hidden state \(h_{t-1}\) passed down from the previous node. \[\textit{Reset gate}:r_{t}=\sigma(W_{r}\cdot[h_{t-1},x_{t}]) \tag{5}\]  
\[Update\;gate:z_{t}=\sigma(W_{z}\cdot[h_{t-1},x_{t}]) \tag{6}\]  
After the GRU model obtains the gating information, it needs to splice the reset data and the input \(x_{i}\), and then use the tanh function to complete the activation task, so that the output from the hidden node can be obtained. The formula is shown in Equation (7). \[\tilde{h}_{t}=\tanh(W\cdot[r_{t}h_{t-1},x_{t}]) \tag{7}\]  
Finally, in the \"update\" stage, the expression is shown in Equation (8). \[h_{t}=(1-z_{t})h_{t-1}+z_{t}\tilde{h}_{t} \tag{8}\]  
In the above formulas, \(W_{r}\), \(W_{z}\), \(W\) represent the corresponding weight matrix. The bidirectional GRU consists of two GRUs for processing sequential data. One of the GRU receives input sequence forward and the other receives backward, so that the bidirectional GRU is able to have the previous and future features in the sequence data learned.