{
  "annotation_id": "e81e25ae-4158-4989-9b7f-5075686ea0ad",
  "date_created": "2026-02-17T05:53:15.301000Z",
  "date_modified": "2026-02-17T05:53:15.301000Z",
  "file_hash": "9a3a2c8396789a1887242d913a97c508701c909b80928adaad7de8e907230a0f",
  "private": false,
  "record": {
    "abstract": "This study independently reproduces the malware detection methodology presented by Felli cious et al. [7], which employs order-invariant API call frequency analysis using Random Forest classification. We utilized the original public dataset (250,533 training samples, 83,511 test samples) and replicated four model variants: Unigram, Bigram, Trigram, and Combined n gram approaches. Our reproduction successfully validated all key findings, achieving F1-scores that exceeded the original results by 0.99% to 2.57% across all models at the optimal API call length of 2,500. The Unigram model achieved F1=0.8717 (original: 0.8631), confirming its ef fectiveness as a lightweight malware detector. Across three independent experimental runs with different random seeds, we observed remarkably consistent results with standard deviations be low 0.5%, demonstrating high reproducibility. This study validates the robustness and scientific rigor of the original methodology while confirming the practical viability of frequency-based API call analysis for malware detection.",
    "arxiv_id": "2601.08725",
    "authors": [
      "Juhani Merilehto"
    ],
    "categories": [
      "cs.CR"
    ],
    "license": "http://creativecommons.org/licenses/by/4.0/",
    "title": "Malware Detection based on API Calls: A Reproducibility Study",
    "url": "https://arxiv.org/abs/2601.08725",
    "version": "v1"
  },
  "schema_id": "dorsal/arxiv",
  "source": {
    "execution_id": "9ca715f8-8bf8-4f8d-8dce-f6d1844ee9cb",
    "id": "arXiv Dataset",
    "type": "Model",
    "variant": "snapshot-2026-01-17",
    "version": "0.1.0"
  },
  "user_id": 1000002
}