Applications of Graph Integration to Function Comparison and Malware Classification

Abstract

We classify .NET files as either benign or malicious by examining directed graphs derived from the set of functions comprising the given file. Each graph is viewed probabilistically as a Markov chain where each node represents a code block of the corresponding function, and by computing the PageRank vector (Perron vector with transport), a probability measure can be defined over the nodes of the given graph. Each graph is vectorized by computing Lebesgue antiderivatives of handengineered functions defined on the vertex set of the given graph against the PageRank measure. Files are subsequently vectorized by aggregating the set of vectors corresponding to the set of graphs resulting from decompiling the given file. The result is a fast, intuitive, and easy-to-compute glass-box vectorization scheme, which can be leveraged for training a standalone classifier or to augment an existing feature space. We refer to this vectorization technique as PageRank Measure Integration Vectorization (PMIV). We demonstrate the efficacy of PMIV by training a vanilla random forest on 2.5 million samples of decompiled .NET, evenly split between benign and malicious, from our in-house corpus and compare this model to a baseline model which leverages a text-only feature space. The median time needed for decompilation and scoring was 24ms. 1

A Survey of Machine Learning Methods and Challenges for Windows Malware Classification

“…Anderson et al (2011) has also used this strategy for assembly sequences in combination with other feature transforms of a graph. A unique approach by Slawinski and Wortman (2019) defined graphs over the extract abstract syntax trees of functions, and used a PageRank based embedding to better capture information from statically extracted features. Using just the static features in a fixed length feature vector they obtained 89.19% accuracy, which increased to 98.28% when leveraging the graph weighted embedding (Slawinski and Wortman, 2019).…”