Intelligent malware detection based on graph convolutional network

Abstract

Malware has seriously threatened the safety of computer systems for a long time. Due to the rapid development of anti-detection technology, traditional detection methods based on static analysis and dynamic analysis have limited effects. With its better predictive performance, AI-based malware detection has been increasingly used to deal with malware in recent years. However, due to the diversity of malware, it is difficult to extract feature from malware, which make malware detection not conductive to the application of AI technology. To solve the problem, a malware classifier based on graph convolutional network is designed to adapt to the difference of malware characteristics. The specific method is to firstly extract the API call sequence from the malware code and generate a directed cycle graph, then use the Markov chain and principal component analysis method to extract the feature map of the graph, and design a classifier based on graph convolutional network, and finally analyze and compare the performance of the method. The results show that the method has better performance in most detection, and the highest accuracy is , compared with existing methods, our model is superior to other methods in terms of FPR and accuracy. It is also stable to deal with the development and growth of malware.

Robust android malware detection based on subgraph network and denoising GCN network

“…Figure 1: The relationship between the K l and the model F1Figure2shows that as the proportion of node confusion increases, our method performs better, and the decline is more stable than Peng's and Li's methods[5][6]. It shows our denoising graph neural network can remove the influence of confusion attack and achieve better detection performance.…”

A Survey on Malware Detection with Graph Representation Learning

“…To address this, some approaches can be employed by jointly using FCGs and CFGs, where embeddings from CFGs are integrated into the nodes of the FCGs, to capture both intra-procedural and inter-procedural semantic [32,33,53]. In the case of Android malware analysis, a prevalent approach is to statically extract the API call sequences from the application and represent them using a FCG [56,58,59,82].…”

Explainable Artificial Intelligence in CyberSecurity: A Survey

“…Keeping with Anomaly-based approaches, Alaeiyan et al introduce [115] VECG, a tool for exploring and supplying required environmental conditions at runtime, while in [116] Stiborek et al propose a novel tool that detects malware observing the interactions between the operating systems and network resources. ASSCA [117] is a system architecture that combines the Deep Learning model based on sequence data and the Machine Learning model based on API statistical features, similar to what happens in [118] where the API call relation is extracted, the ordered cycle graph is constructed based on 6 https://www.av-test.org/en/statistics/malware/ 7 https://www.statista.com/topics/8338/malware/dossierKeyfigures Markov chain and then the graph convolution neural network (GCN) detects malware. Other exciting works based on Deep Learning of Behavior Graphs are [119], [120] where for the detection are used file content and file relations.…”