CFGExplainer: Explaining Graph Neural Network-Based Malware Classification from Control Flow Graphs

Herath, J. Dinal; Wakodikar, Priti Prabhakar; Yang, Ping; Yan, Guanhua

doi:10.1109/dsn53405.2022.00028

Cited by 18 publications

(10 citation statements)

References 33 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…As described in Section II-D, Yakura et al's method [29] and CFGExplainer [6] have different feature units from our method. Yakura et al state that the byte sequence of the original executable can be identified by extracting the pixel regions of the image.…”

Section: A Effectiveness Of Our Methodsmentioning

confidence: 91%

“…In the experiment by Herath et al [6], the 10% subgraph created by CFGExplainer showed 52.39% accuracy. In contrast, the 10% subgraph created by FCGAT achieves 71.73% accuracy.…”

Section: ) Datasetsmentioning

confidence: 95%

“…In the latest study, Herath et al [6] proposed CFGExplainer, an explanatory method in GNN-based malware classification models. CFGExplainer obtains the node importance in CFG subgraph by pruning nodes that do not contribute to classification and identifying the subgraphs that contribute the most to classification.…”

Section: Explanation Techniques In Malware Classificationmentioning

confidence: 99%

“…In this experiment, we excluded as many packed files as possible to focus on the malware features. We excluded from BODMAS those samples that have been pack-detected by PEiD 6 . Then, the category with more than 90 samples in each malware category was selected among the successfully preprocessed samples.…”

Section: ) Datasetsmentioning

confidence: 99%

“…To verify that the attention weights reflect the contributing functions for the classification, we evaluate classification performance using only important functions with higher attention weights. This evaluation method is based on the method of Herath et al [6]. We create subgraph datasets consisting of functions with high attention weights by varying the number of nodes, and evaluate their performance.…”

Section: ) Datasetsmentioning

confidence: 99%

See 4 more Smart Citations

FCGAT: Interpretable Malware Classification Method using Function Call Graph and Attention Mechanism

Someya¹,

Otsubo²,

Otsuka³

2023

Proceedings 2023 Workshop on Binary Analysis Research

View full text Add to dashboard Cite

Malware classification facilitates static analysis, which is manually intensive but necessary work to understand the inner workings of unknown malware. Machine learning based approaches have been actively studied and have great potential. However, their drawback is that their models are considered black boxes and are challenging to explain their classification results and thus cannot provide patterns specific to malware. To address this problem, we propose FCGAT, the first malware classification method that provides interpretable classification reasons based on program functions. FCGAT applies natural language processing techniques to create function features and updates them to reflect the calling relationships between functions. Then, it applies attention mechanism to create malware feature by emphasizing the functions that are important for classification with attention weights. FCGAT provides an importance ranking of functions based on attention weights as an explanation. We evaluate the performance of FCGAT on two datasets. The results show that the F1-Scores are 98.15% and 98.18%, which are competitive with the cutting-edge methods. Furthermore, we examine how much the functions emphasized by FCGAT contribute to the classification. Surprisingly, our result show that only top 6 (average per sample) highly-weighted functions yield as much as 70% accuracy. We also show that these functions reflect the characteristics of malware by analyzing them. FCGAT can provide analysts with reliable explanations using a small number of functions. These explanations could bring various benefits, such as improved efficiency in malware analysis and comprehensive malware trend analysis.

show abstract

Section: A Effectiveness Of Our Methodsmentioning

confidence: 91%

“…In the experiment by Herath et al [6], the 10% subgraph created by CFGExplainer showed 52.39% accuracy. In contrast, the 10% subgraph created by FCGAT achieves 71.73% accuracy.…”

Section: ) Datasetsmentioning

confidence: 95%

Section: Explanation Techniques In Malware Classificationmentioning

confidence: 99%

Section: ) Datasetsmentioning

confidence: 99%

Section: ) Datasetsmentioning

confidence: 99%

See 3 more Smart Citations

FCGAT: Interpretable Malware Classification Method using Function Call Graph and Attention Mechanism

Someya¹,

Otsubo²,

Otsuka³

2023

Proceedings 2023 Workshop on Binary Analysis Research

View full text Add to dashboard Cite

show abstract

A Survey of Control Flow Graph Recovery for Binary Code

Wang,

Li,

Yue

et al. 2023

Communications in Computer and Information Science

View full text Add to dashboard Cite

Certifying Accuracy, Privacy, and Robustness of ML-Based Malware Detection

Bena,

Anisetti,

Gianini

et al. 2024

SN COMPUT. SCI.

View full text Add to dashboard Cite

Recent advances in artificial intelligence (AI) are radically changing how systems and applications are designed and developed. In this context, new requirements and regulations emerge, such as the AI Act, placing increasing focus on strict non-functional requirements, such as privacy and robustness, and how they are verified. Certification is considered the most suitable solution for non-functional verification of modern distributed systems, and is increasingly pushed forward in the verification of AI-based applications. In this paper, we present a novel dynamic malware detector driven by the requirements in the AI Act, which goes beyond standard support for high accuracy, and also considers privacy and robustness. Privacy aims to limit the need of malware detectors to examine the entire system in depth requiring administrator-level permissions; robustness refers to the ability to cope with malware mounting evasion attacks to escape detection. We then propose a certification scheme to evaluate non-functional properties of malware detectors, which is used to comparatively evaluate our malware detector and two representative deep-learning solutions in literature.

show abstract

CFGExplainer: Explaining Graph Neural Network-Based Malware Classification from Control Flow Graphs

Cited by 18 publications

References 33 publications

FCGAT: Interpretable Malware Classification Method using Function Call Graph and Attention Mechanism

FCGAT: Interpretable Malware Classification Method using Function Call Graph and Attention Mechanism

A Survey of Control Flow Graph Recovery for Binary Code

Certifying Accuracy, Privacy, and Robustness of ML-Based Malware Detection

Contact Info

Product

Resources

About