# A Benchmark API Call Dataset for Windows PE Malware Classification

arXiv: https://arxiv.org/abs/1905.01999 · HTML: https://mlsanity.com/paper/1905.01999/

## Key facts

- Cited by 3 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 6 May 2019.

## Built on by (most cited first, 3 of 3)

- [Comprehensive evaluation of Mal-API-2019 dataset by machine learning in malware detection](https://mlsanity.com/paper/2403.02232/) (2024)
- [An Ensemble of Pre-trained Transformer Models For Imbalanced Multiclass Malware Classification](https://mlsanity.com/paper/2112.13236/) (2021)
- [Benchmark Static API Call Datasets for Malware Family Classification](https://mlsanity.com/paper/2111.15205/) (2021)

## Abstract (arXiv)

The use of operating system API calls is a promising task in the detection of PE-type malware in the Windows operating system. This task is officially defined as running malware in an isolated sandbox environment, recording the API calls made with the Windows operating system and sequentially analyzing these calls. Here, we have analyzed 7107 different malicious software belonging to various families such as virus, backdoor, trojan in an isolated sandbox environment and transformed these analysis results into a format where different classification algorithms and methods can be used. First, we'll explain how we got the malware, and then we'll explain how we've got these software bundled into families. Finally, we will describe how to perform malware classification tasks using different computational methods for the researchers who will use the data set we have created.