# Dynamic Malware Analysis with Feature Engineering and Feature Learning

arXiv: https://arxiv.org/abs/1907.07352 · HTML: https://mlsanity.com/paper/1907.07352/

## Key facts

- Cited by 23 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 17 Jul 2019.

## Built on by (most cited first, 23 of 23)

- [Kairos: Practical Intrusion Detection and Investigation using Whole-system Provenance](https://mlsanity.com/paper/2308.05034/) (2023)
- [Adversarial Attacks against Windows PE Malware Detection: A Survey of the State-of-the-Art](https://mlsanity.com/paper/2112.12310/) (2021)
- [RS-Del: Edit Distance Robustness Certificates for Sequence Classifiers via Randomized Deletion](https://mlsanity.com/paper/2302.01757/) (2023)
- [Decoding the Secrets of Machine Learning in Malware Classification: A Deep Dive into Datasets, Feature Extraction, and Model Performance](https://mlsanity.com/paper/2307.14657/) (2023)
- [OPORP: One Permutation + One Random Projection](https://mlsanity.com/paper/2302.03505/) (2023)
- [Nebula: Self-Attention for Dynamic Malware Analysis](https://mlsanity.com/paper/2310.10664/) (2023)
- [Prompt Engineering-assisted Malware Dynamic Analysis Using GPT-4](https://mlsanity.com/paper/2312.08317/) (2023)
- [Semantic-aware Binary Code Representation with BERT](https://mlsanity.com/paper/2106.05478/) (2021)
- [Differential Privacy with Random Projections and Sign Random Projections](https://mlsanity.com/paper/2306.01751/) (2023)
- [CNN-LSTM and Transfer Learning Models for Malware Classification based on Opcodes and API Calls](https://mlsanity.com/paper/2405.02548/) (2024)
- [Burning the Adversarial Bridges: Robust Windows Malware Detection Against Binary-level Mutations](https://mlsanity.com/paper/2310.03285/) (2023)
- [MG-DVD: A Real-time Framework for Malware Variant Detection Based on Dynamic Heterogeneous Graph Learning](https://mlsanity.com/paper/2106.12288/) (2021)
- [Malicious Code Detection: Run Trace Output Analysis by LSTM](https://mlsanity.com/paper/2101.05646/) (2021)
- [SeqNet: An Efficient Neural Network for Automatic Malware Detection](https://mlsanity.com/paper/2205.03850/) (2022)
- [CARE: Ensemble Adversarial Robustness Evaluation Against Adaptive Attackers for Security Applications](https://mlsanity.com/paper/2401.11126/) (2024)
- [PIDSMaker: Building and Evaluating Provenance-based Intrusion Detection Systems](https://mlsanity.com/paper/2601.22983/) (2026)
- [Trident: Improving Malware Detection with LLMs and Behavioral Features](https://mlsanity.com/paper/2605.00297/) (2026)
- [The Implications of Linguistic Illegibility for LLM Security](https://mlsanity.com/paper/2609.02852/) (2026)
- [Malware Analysis with Symbolic Execution and Graph Kernel](https://mlsanity.com/paper/2204.05632/) (2022)
- [A Lean Transformer Model for Dynamic Malware Analysis and Detection](https://mlsanity.com/paper/2408.02313/) (2024)
- [BEACON: Behavioral Malware Classification with Large Language Model Embeddings and Deep Learning](https://mlsanity.com/paper/2509.14519/) (2025)
- [SoK: AI-Augmented Binary Reversing](https://mlsanity.com/paper/2606.17398/) (2026)
- [EGAMA-RC: Risk-Calibrated Evidence-Gated Adaptive Malware Analysis for Robust and Interpretable Memory-Forensic Triage](https://mlsanity.com/paper/2608.22721/) (2026)

## Abstract (arXiv)

Dynamic malware analysis executes the program in an isolated environment and monitors its run-time behaviour (e.g. system API calls) for malware detection. This technique has been proven to be effective against various code obfuscation techniques and newly released ("zero-day") malware. However, existing works typically only consider the API name while ignoring the arguments, or require complex feature engineering operations and expert knowledge to process the arguments. In this paper, we propose a novel and low-cost feature extraction approach, and an effective deep neural network architecture for accurate and fast malware detection. Specifically, the feature representation approach utilizes a feature hashing trick to encode the API call arguments associated with the API name. The deep neural network architecture applies multiple Gated-CNNs (convolutional neural networks) to transform the extracted features of each API call. The outputs are further processed through bidirectional LSTM (long-short term memory networks) to learn the sequential correlation among API calls. Experiments show that our solution outperforms baselines significantly on a large real dataset. Valuable insights about feature engineering and architecture design are derived from the ablation study.