I wonder what are the features that the model use to judge whether this app is a goodware or malware,how do I judge the good API or bad API call?