Abstract:At present, the trend of familiarization of malicious code is becoming more and more obvious, and the research on the homology of malware (the classification of malicious code family) is of great significance for maintaining network security. In order to better express the overall characteristics of malicious code and improve the effect of detection and homology analysis, this paper proposes a method for detection and homology analysis of malware based on heterogeneous graphs of assembly instructions (AIHGAT). We take the assembly instructions of malicious families as the research object and analyze the importance and correlation of assembly instructions of different malicious families. The malware detection and homology analysis are carried out in three aspects: feature extraction, feature preprocessing, and model construction. In the feature extraction of malicious code, in order to alleviate the problem that it is difficult to extract static features of malicious samples that contain countermeasures such as packing and obfuscation, we obtain binary files from dynamic memory through sandbox and then, analyze its assembly instruction set. In feature preprocessing, we divide the assembly instructions into N-tuples and construct a heterogeneous graph based on assembly instructions according to the internal correlation of the gene sequence composed of the assembly N-grams features. Finally, in terms of model construction, we analyze the homology determination effect of the traditional graph neural network and construct the Graph Attention Network based on residual connection named ResGAT to analyze the homology of malicious code. The experimental results show that the ResGAT can gather the core characteristics of malicious families and enhance the ability to recognize malicious family variants. Our model has an accuracy rate of 98.83%, which is better than traditional machine learning detection methods, and can effectively determine the homology of malicious code families.

A Function Call Graph Extraction Method Combining Static and Dynamic Analysis

Detecting Malware Variants Via Function-Call Graph Similarity

A Similarity Metric Method of Obfuscated Malware Using Function-Call Graph

FMDiv: Functional Module Division on Binary Malware for Accurate Malicious Code Localization.

Malware Detection Based on Critical Application Programming Interface Graph

An unknown malware detection scheme based on the features of graph

Guided Malware Sample Analysis based on Graph Neural Networks

Design and Implementation of Malware Automated Analysis Tool Based on Behavior Analysis

AMDroid: Android Malware Detection Using Function Call Graphs

Method of Malware Behavior Analysis in Disassembly Level

Component Similarity Based Methods for Automatic Analysis of Malicious Executables

HGDetector: A Hybrid Android Malware Detection Method Using Network Traffic and Function Call Graph

A dynamic Windows malware detection and prediction method based on contextual understanding of API call sequence

Dynamic Analysis of Malicious Code

Sensitive Behavioral Chain-Focused Android Malware Detection Fused With AST Semantics

Enhancing android malware detection explainability through function call graph APIs

Using deep graph learning to improve dynamic analysis-based malware detection in PE files

Malware Analysis Using Machine Learning and Deep Learning Techniques

Function-level Obfuscation Detection Method Based on Graph Convolutional Networks

Learning features from enhanced function call graphs for Android malware detection

AIHGAT: A novel method of malware detection and homology analysis using assembly instruction heterogeneous graph