Malware Classification with n-gram Based NLP and Cosine Similarity

Abstract

Malware classification is a fundamental aspect of cybersecurity, essential for detecting and mitigating threats. This paper introduces a malware classification technique that applies Natural Language Processing (NLP) methods alongside Cosine similarity. Our approach involves using n-grams of API call sequences, including the API names, their arguments, and categories, to characterize malware behavior. By computing Cosine similarity between these n-grams, we effectively capture both similarities and differences in malware behavior. Our experimental results show that different n-gram configurations exhibit varying classification capabilities, with some proving more effective for specific types of malware. Overall, our technique presents a promising solution for malware classification, leveraging NLP and Cosine similarity to improve the accuracy and efficiency of malware variant detection.