| Title:
|
From API calls to behavioral graphs: state-clustering and Markov transition features for classical and quantum malware detection (English) |
| Author:
|
Youssef, Aktham |
| Author:
|
Zelinka, Ivan |
| Author:
|
Amer, Eslam |
| Language:
|
English |
| Journal:
|
Kybernetika |
| ISSN:
|
0023-5954 (print) |
| ISSN:
|
1805-949X (online) |
| Volume:
|
62 |
| Issue:
|
3 |
| Year:
|
2026 |
| Pages:
|
456-480 |
| Summary lang:
|
English |
| . |
| Category:
|
math |
| . |
| Summary:
|
This paper presents a malware-detection pipeline for Windows API-call sequences that converts variable-length traces into fixed-length behavioral features. API tokens are embedded with Word2Vec and clustered with $K$-means to form a shared behavioral state space, and each trace is summarized by first-order Markov transition frequencies ($S^2$ features). Experiments on 150,656 traces with a family-aware split (20\. (English) |
| Keyword:
|
malware detection |
| Keyword:
|
API call sequences |
| Keyword:
|
Word2Vec |
| Keyword:
|
$K$-means |
| Keyword:
|
Markov transitions |
| Keyword:
|
quantum machine learning |
| Keyword:
|
QSVM |
| Keyword:
|
VQC |
| MSC:
|
68M25 |
| MSC:
|
68T05 |
| MSC:
|
68T10 |
| MSC:
|
81P68 |
| DOI:
|
10.14736/kyb-2026-3-0456 |
| . |
| Date available:
|
2026-07-15T16:26:36Z |
| Last updated:
|
2026-07-15 |
| Stable URL:
|
http://hdl.handle.net/10338.dmlcz/153683 |
| . |
| Reference:
|
[1] Amer, E., El-Sappagh, S., Abuhamad, T., Al-Rimy, B. Ali Saleh, Mohasseb, A.: Graphshield: Advanced dynamic graph-based malware detection using graph neural networks..Expert Systems Appl. (2025). |
| Reference:
|
[2] Amer, E., Zelinka, I.: A dynamic windows malware detection and prediction method based on contextual understanding of api call sequence..Computers Security 92 (2020), 101760. |
| Reference:
|
[3] Amer, E., Zelinka, I., El-Sappagh, S.: A multi-perspective malware detection approach through behavioral fusion of api call sequence..Computers Security 110 (2021), 102449. |
| Reference:
|
[4] Barrué, G., Quertier, T.: Quantum machine learning for malware classification..In: Joint European Conference on Machine Learning and Knowledge Discovery in Databases (ECML PKDD), Springer 2023, pp. 245-260. |
| Reference:
|
[5] Bellante, A., Fioravanti, T., Carminati, M., Zanero, S-, Luongo, A.: Evaluating the potential of quantum machine learning in cybersecurity: A case-study on pca-based intrusion detection systems..Computers Security 154 (2025), 104341. |
| Reference:
|
[6] Cerezo, M., Sone, A., Volkoff, T., Cincio, L., Coles, P. J.: Variational quantum algorithms..Nature Rev. Phys. 3 (2021), 625-644. |
| Reference:
|
[7] Cui, L-, Cui, J., Ji, Y., Hao, Z., Li, L., Ding, Z.: Api2vec: Learning representations of api sequences for malware detection..In: Proc. 32nd ACM SIGSOFT International Symposium on Software Testing and Analysis 2023, pp. 261-273. |
| Reference:
|
[8] Fawcett, T.: An introduction to roc analysis..Pattern Recogn. Lett. 27 (2006), 8, 861-874. |
| Reference:
|
[9] Havlíček, V., Córcoles, A. D., Temme, K., Harrow, A. W., Kandala, A., Chow, J. M., Gambetta, J. M.: Supervised learning with quantum-enhanced feature spaces..Nature 567 (2019), 7747, 209-212. |
| Reference:
|
[10] Kwon, I., Im, E. G.: Extracting the representative api call patterns of malware families using recurrent neural network..In: Proc. International Conference on Research in Adaptive and Convergent Systems 2017, pp. 202-207. |
| Reference:
|
[11] Mariconti, E., Onwuzurike, L., Andriotis, P., Cristofaro, E.De, Ross, G., Stringhini, G.: MAMADroid: Detecting android malware by building markov chains of behavioral models..In: Proc. Network and Distributed System Security Symposium (NDSS). Internet Society 2017. |
| Reference:
|
[12] McClean, J. R., Boixo, S., Smelyanskiy, V. N., Babbush, R., Neven, H.: Barren plateaus in quantum neural network training landscapes..Nature Commun. 9 (2018), 4812. 10.1038/s41467-018-07090-4 |
| Reference:
|
[13] Mikolov, T., Chen, K., Corrado, G., Dean, J.: Efficient estimation of word representations in vector space..arXiv preprint, arXiv:1301.3781, 2013. |
| Reference:
|
[14] Or-Meir, O., Nissim, N., Elovici, Y., Rokach, L.: Dynamic malware analysis in the modern era-a state of the art survey..ACM Comput. Surveys, 2019. |
| Reference:
|
[15] Sahin, M. Emre, Altamura, Edoardo, Wallis, Oscar, Wood, Stephen P., Dekusar, Anton, Millar, Declan A., Imamichi, Takashi, Matsuo, Atsushi, Mensa, Stefano: Qiskit machine learning: an open-source library for quantum machine learning tasks at scale on quantum hardware and classical simulators..arXiv preprint, arXiv:2505.17756, 2025. |
| Reference:
|
[16] Saito, T., Rehmsmeier, M.: The precision-recall plot is more informative than the roc plot when evaluating binary classifiers on imbalanced datasets..PLOS ONE 10 (2015), 3, e0118432. |
| Reference:
|
[17] Schuld, M.: Supervised quantum machine learning models are kernel methods..arXiv preprint, arXiv:2101.11020, 2021. |
| Reference:
|
[18] Thanasilp, S., Wang, S., Cerezo, M., Holmes, Z.: Exponential concentration in quantum kernel methods..Nature Commun. 15 (2024), 1. 10.1038/s41467-024-49287-w |
| Reference:
|
[19] Zelinka, I., Amer, E.: An ensemble-based malware detection model using minimum feature set..In: Mendel 25 (2019), pp. 1-10. |
| Reference:
|
[20] Catak, F. O., Yazi, A. F., Elezaj, O., Ahmed, J.: Deep learning based sequential model for malware analysis using windows exe api calls..PeerJ Computer Sci. (2020), 6, e285. |
| . |
