Abstract:At present, the trend of familiarization of malicious code is becoming more and more obvious, and the research on the homology of malware (the classification of malicious code family) is of great significance for maintaining network security. In order to better express the overall characteristics of malicious code and improve the effect of detection and homology analysis, this paper proposes a method for detection and homology analysis of malware based on heterogeneous graphs of assembly instructions (AIHGAT). We take the assembly instructions of malicious families as the research object and analyze the importance and correlation of assembly instructions of different malicious families. The malware detection and homology analysis are carried out in three aspects: feature extraction, feature preprocessing, and model construction. In the feature extraction of malicious code, in order to alleviate the problem that it is difficult to extract static features of malicious samples that contain countermeasures such as packing and obfuscation, we obtain binary files from dynamic memory through sandbox and then, analyze its assembly instruction set. In feature preprocessing, we divide the assembly instructions into N-tuples and construct a heterogeneous graph based on assembly instructions according to the internal correlation of the gene sequence composed of the assembly N-grams features. Finally, in terms of model construction, we analyze the homology determination effect of the traditional graph neural network and construct the Graph Attention Network based on residual connection named ResGAT to analyze the homology of malicious code. The experimental results show that the ResGAT can gather the core characteristics of malicious families and enhance the ability to recognize malicious family variants. Our model has an accuracy rate of 98.83%, which is better than traditional machine learning detection methods, and can effectively determine the homology of malicious code families.

Assembly Reverse Analysis on Malicious Code of Web Rootkit Trojan

Defense of Hidden Backdoor Technology for Web

Web Page Trojan Detection Method Based on Dynamic Behavior Analysis

Design and Implementation of an Automated Malware Dynamic Analysis System

Virus Analysis on IDT Hooks of Rootkits Trojan

The Reversing Machine: Reconstructing Memory Assumptions

Synthetic approach for Windows Rootkit analysis and detection

Research of Rootkit Technology and Detection Method

REVERSE AUTOMATED ANALYSIS OF APT TROJAN NETWORK PROTOCOL

Reviving Android Malware with DroidRide: and How Not To.

Research and Implementation of the Module Binary Analysis for Rootkit Dectection

Dynamic Analysis of Malicious Code

Unmasking the Shadows: Pinpoint the Implementations of Anti-Dynamic Analysis Techniques in Malware Using LLM

Design and Implementation of Malware Automated Analysis Tool Based on Behavior Analysis

Reverse Technique Of Malicious Obfuscated Binary Code Based On Control Flow Graph

Dynamic Rootkit Detection Methodology Based on Branch Instruction Analysis

Android Malicious Behavior Detection based on Reverse Engineering

Mwsandbox: On Improving The Efficiency Of Automated Coarse-Grained Dynamic Malware Analysis

Method of Malware Behavior Analysis in Disassembly Level

AIHGAT: A novel method of malware detection and homology analysis using assembly instruction heterogeneous graph

deRop: removing return-oriented programming from malware