The premise
Static signatures miss novel malware, because changing a file's bytes is trivial while changing what it does is not. Behaviour is the more honest signal — so the question becomes how to model a sequence of actions rather than a file.
The pipeline
Samples execute in a sandbox, and their API call sequences are logged with timestamps. Sequences are cleaned and padded to a fixed length, with class imbalance handled through SMOTE and class weighting rather than being ignored — malware datasets are almost never balanced, and accuracy on an imbalanced set is a meaningless number.
Why embeddings
API calls are treated like words: Word2Vec and API2Vec turn each call into a vector, so calls that appear in similar contexts end up near each other. That gives the model a notion of similarity between operations it has never seen in that exact order — which is the whole point when the threat is novel.
The model
A Bidirectional GRU with an attention layer, feeding a dense sigmoid head. Bidirectional because malicious intent is often only obvious in hindsight — a benign-looking call early in a sequence reads differently once you know what followed. Attention because it surfaces which calls drove a verdict, which matters if an analyst has to defend the classification.
Evaluation
Scored on accuracy, AUC, confusion matrix, and a full classification report, with the reporting flow designed for analyst consumption rather than a single headline number.