Abstract:Malware represents a significant security concern in today's digital landscape, as it can destroy or disable operating systems, steal sensitive user information, and occupy valuable disk space. However, current malware detection methods, such as static-based and dynamic-based approaches, struggle to identify newly developed (``zero-day") malware and are limited by customized virtual machine (VM) environments. To overcome these limitations, we propose a novel malware detection approach that leverages deep learning, mathematical techniques, and network science. Our approach focuses on static and dynamic analysis and utilizes the Low-Level Virtual Machine (LLVM) to profile applications within a complex network. The generated network topologies are input into the GraphSAGE architecture to efficiently distinguish between benign and malicious software applications, with the operation names denoted as node features. Importantly, the GraphSAGE models analyze the network's topological geometry to make predictions, enabling them to detect state-of-the-art malware and prevent potential damage during execution in a VM. To evaluate our approach, we conduct a study on a dataset comprising source code from 24,376 applications, specifically written in C/C++, sourced directly from widely-recognized malware and various types of benign software. The results show a high detection performance with an Area Under the Receiver Operating Characteristic Curve (AUROC) of 99.85%. Our approach marks a substantial improvement in malware detection, providing a notably more accurate and efficient solution when compared to current state-of-the-art malware detection methods.

A malicious software evaluation system based on behavior association

LSTM Android Malicious Behavior Analysis Based on Feature Weighting

A Behavior-Based Approach For Malware Detection

Technique of Detecting Malicious Executables Via Behavioral and Binary Signatures

K-Means Clustering Analysis Based On Adaptive Weights For Malicious Code Detection

A Malware Detection Method Based On Active Learning For Database

Malicious software detection method and device

Behavior-based malicious executables detection by multi-class SVM

HRS: A Hybrid Framework for Malware Detection.

A Dynamic and Static Combined Android Malicious Code Detection Model Based on SVM.

A Malicious Behavior Analysis Method Based on Program Semantic

Behavior-Based Malware Analysis and Detection

MALWARE DETECTION BASED ON OBJECTIVE-ORIENTED ASSOCIATION MINING

Behavior-Based Proactive Detection of Unknown Malicious Codes

Real-Time Behavior Analysis and Identification for Android Application

An Android Behavior-Based Malware Detection Method Using Machine Learning

The Similarity Analysis of Malicious Software

VDS : Malware Detection System

Discovering Malicious Signatures in Software from Structural Interactions

Behavior-Based Malware Detection on Mobile Phone

Application of CLIPS Expert System to Malware Detection System