Final performance metrics after 100 epochs.

Malware classification is a challenging task due to the constantly evolving nature of malicious software. Traditional signature-based methods and static analysis often fail to detect sophisticated threats, making behavior-based analysis crucial. This study proposes a malware detection model that analyzes the behavior of executable files (.exe) to classify them as malware. The model submits the file to VirusTotal, where it runs in a secure environment to monitor actions such as file modifications, registry changes, or network connections. To enhance detection accuracy, the BERT model is applied to extract key features from these behavior logs. After 100 training epochs, the model achieved 92.25% accuracy and an F1-score of 91.22%, demonstrating strong overall performance. Class-wise evaluation was also conducted, treating each malware family as a distinct class to assess specific detection accuracy. Furthermore, a correlation matrix was analyzed to explore inter-class relationships and identify overlapping behaviors. Experimental results show that SVM achieved the highest F1-Scores for Adware (0.98) and BackDoor (0.91), while Random Forest showed comparable performance. Naïve Bayes, however, performed poorly for FakeAlert (F1-Score: 0.64). These findings confirm the effectiveness of the proposed behavior-based approach using BERT features, with SVM and Random Forest proving to be the most reliable classifiers.恶意软件分类是一项极具挑战性的任务，原因在于恶意软件始终处于不断演化的状态。传统基于签名的检测方法与静态分析往往难以识别复杂的高级威胁，因此基于行为的分析变得至关重要。本研究提出了一款恶意软件检测模型，该模型通过分析可执行文件（.exe）的行为来实现恶意软件分类。该模型将待测文件提交至VirusTotal平台，在安全沙箱环境中运行并监控其文件修改、注册表变更、网络连接等行为。为提升检测准确率，本研究采用BERT模型从上述行为日志中提取关键特征。经100个训练周期后，该模型的分类准确率达到92.25%，F1值为91.22%，整体性能优异。研究同时开展了类别级评估，将每个恶意软件家族视为独立类别，以评估其专属检测精度。此外，本研究还通过分析相关性矩阵探究类别间的关联关系，识别存在行为重叠的恶意软件家族。实验结果显示，支持向量机（SVM）在广告软件（Adware，F1值0.98）与后门程序（BackDoor，F1值0.91）的检测中取得了最高F1值，随机森林（Random Forest）的表现与之相当。而朴素贝叶斯（Naïve Bayes）在虚假警报类（FakeAlert）恶意软件的检测中表现不佳，F1值仅为0.64。上述实验结果证实了基于行为分析并结合BERT特征的检测方法的有效性，且支持向量机与随机森林被证明是最为可靠的分类器。