Attention-Based BiLSTM For Malware Family Classification

Due to API calls being the most prominent characteristic of malicious software, this paper uses Windows API call sequences as features to classify malware families. A BiLSTM model based on attention mechanism is proposed. First, to address the problem of significantly different sample lengths, an algorithm for preprocessing Windows API call sequences of different lengths is improved, referred to as RD in this paper. RD can effectively remove duplicate APIs and reduce the length of API call sequences, and experimental results show that this preprocessing algorithm can improve the classification accuracy. Then, considering the temporal nature of API calls, this paper uses a BiLSTM model that can perceive contextual information and integrates an attention mechanism to improve the model's performance. Experimental results show that the attention-based BiLSTM model outperforms other models.