Behavioural Analysis of Malware by Selecting Influential API Through TF-IDF API Embeddings

The constant threat of malware makes studying its behavior an ongoing task. Malware identification and clas-sification challenges can be solved better by analyzing software behaviorally rather than using conventional hashcode-based signatures. API sequence represents the behavior of any program when collected during its execution. Considering API sequences gathered while the malware was being executed in controlled conditions, this report addresses the issue of choosing influential APIs for malware. The suggested feature selection method Select API in this research selects key features, i.e., significant APIs, that can better classify malware using TF-IDF API embeddings. Two machine learning models, Random Forest, which ensemble several estimators implicitly, and Support Vector Classifier, a standard non-linear model, are trained and evaluated to validate the importance of the chosen APIs. The proposed API selection methodology, called SelectAPI, has shown promising results. It achieves accuracy, macro-avg precision-score, macro-avg recall-score, and macro-avg F1-score of 0.76, 0.77, 0.76, and 0.76, respectively. This method focuses on selecting influential APIs and has resulted in significantly improved performance on the open-benchmark multiclass dynamic-API-Sequence based malware dataset, MAL-API-2019. These results surpass the previously best-known accuracy value of 0.60 and reported F1-Score of 0.61.

@article{Panda2025,
  title     = {Behavioural Analysis of Malware by Selecting Influential API Through TF-IDF API Embeddings},
  journal   = {International Journal of Advanced Computer Science and Applications},
  volume    = {16},
  number    = {5},
  year      = {2025},
  publisher = {The Science and Information Organization},
  author    = {Binayak Panda and Sudhanshu Shekhar Bisoyi and Sidhanta Panigrahy},
  doi       = {10.14569/IJACSA.2025.0160575},
  url       = {https://doi.org/10.14569/IJACSA.2025.0160575}
}