🤖 AI Summary
This study validates and reproduces a malware detection approach based on API call frequency, with a focus on its reproducibility and robustness. Using a Random Forest classifier, the authors construct four model variants—Unigram, Bigram, Trigram, and combined n-grams—and evaluate them on API sequences of length 2,500. The experiments independently confirm for the first time that the original method exhibits high performance stability across different random seeds, with a standard deviation below 0.5% over three trials. Moreover, all model variants achieve F1 scores surpassing those reported in the original study by 0.99% to 2.57%, with the Unigram model reaching an F1 score of 0.8717. These results significantly enhance the scientific rigor and practical viability of the API-based malware detection methodology.
📝 Abstract
This study independently reproduces the malware detection methodology presented by Felli cious et al. [7], which employs order-invariant API call frequency analysis using Random Forest classification. We utilized the original public dataset (250,533 training samples, 83,511 test samples) and replicated four model variants: Unigram, Bigram, Trigram, and Combined n gram approaches. Our reproduction successfully validated all key findings, achieving F1-scores that exceeded the original results by 0.99% to 2.57% across all models at the optimal API call length of 2,500. The Unigram model achieved F1=0.8717 (original: 0.8631), confirming its ef fectiveness as a lightweight malware detector. Across three independent experimental runs with different random seeds, we observed remarkably consistent results with standard deviations be low 0.5%, demonstrating high reproducibility. This study validates the robustness and scientific rigor of the original methodology while confirming the practical viability of frequency-based API call analysis for malware detection.