# Model suggestion for detection of malware based on multiple api call sequences

I'm trying to build a RNN (LSTM) model for classification of binary as benign/malware. The data structure I've presently looks as follows

{
"binary1": {
"label": 1,
"sequences": [
["api1","api2","api3", ...],
["api1","api2","api3", ...],
["api1","api2","api3", ...],
["api1","api2","api3", ...],
...
]
},
"binary2": {
"label": 0,
"sequences": [
["api1","api2","api3", ...],
["api1","api2","api3", ...],
["api1","api2","api3", ...],
["api1","api2","api3", ...],
...
]
},
...
}


Here each binary have variable number of sequences, and each sequence have variable number of API calls. I can pad the data so that all binaries will have equal number of sequences and each sequence also have equal number of API calls. But my question is how can I use this data for training?

The problem is that, all the sequences of the malicious binary may not be malicious sequences. So, if I use the label and indicate the model that all those sequences are malicious and if some of the sequences are similar in benign files also, the benign binary may be treated as malware.

To better understand the problem, treat each binary as a person on twitter, and each API call sequences as a words in a tweet. A user may tweet so many tweets, but a few of them may be about sports (for eg). And in my training data I know which persons tweets about sports, but I don't know which tweets are about sports. So, what I'm trying to do is classifying those persons whether they like sports or not based on all the tweets of the person.

In the same way, I know whether the binary is malicious or not, but I don't know which API call sequences are responsible for maliciousness. And I want the model to identify those sequences from the training data. Is it possible? And what architecture should I use?

Hope I conveyed my question, thanks for reading and waiting for a suggestion.