Clustering of Application Behaviors in Windows Environments

This paper introduces an innovative approach that utilizes n-gram modeling, K-Means clustering, and advanced statistical techniques to examine the API sequence patterns of Windows applications. By extracting API calls of applications using Cuckoo Sandbox, we create n-grams to capture complex API sequence patterns that offer a contextual understanding of application behaviors. The Elbow method helps to determine optimal clusters, which are then analyzed using K-Means clustering and validated by silhouette scores. Our research focuses on understanding behavioral patterns across benign applications, enhancing both cybersecurity strategies and software analytics without concentrating solely on malware detection or classification.