Abstract:At present, the trend of familiarization of malicious code is becoming more and more obvious, and the research on the homology of malware (the classification of malicious code family) is of great significance for maintaining network security. In order to better express the overall characteristics of malicious code and improve the effect of detection and homology analysis, this paper proposes a method for detection and homology analysis of malware based on heterogeneous graphs of assembly instructions (AIHGAT). We take the assembly instructions of malicious families as the research object and analyze the importance and correlation of assembly instructions of different malicious families. The malware detection and homology analysis are carried out in three aspects: feature extraction, feature preprocessing, and model construction. In the feature extraction of malicious code, in order to alleviate the problem that it is difficult to extract static features of malicious samples that contain countermeasures such as packing and obfuscation, we obtain binary files from dynamic memory through sandbox and then, analyze its assembly instruction set. In feature preprocessing, we divide the assembly instructions into N-tuples and construct a heterogeneous graph based on assembly instructions according to the internal correlation of the gene sequence composed of the assembly N-grams features. Finally, in terms of model construction, we analyze the homology determination effect of the traditional graph neural network and construct the Graph Attention Network based on residual connection named ResGAT to analyze the homology of malicious code. The experimental results show that the ResGAT can gather the core characteristics of malicious families and enhance the ability to recognize malicious family variants. Our model has an accuracy rate of 98.83%, which is better than traditional machine learning detection methods, and can effectively determine the homology of malicious code families.

Malicious Code Family Tagging based on Malicious Code Image Fingerprint

A malicious code family classification method based on self-attention mechanism

FMDiv: Functional Module Division on Binary Malware for Accurate Malicious Code Localization.

Malware Analysis Using Machine Learning and Deep Learning Techniques

Automatic Malware Description via Attribute Tagging and Similarity Embedding

Detection of Malicious Code Variants Based on Deep Learning

K-Means Clustering Analysis Based On Adaptive Weights For Malicious Code Detection

Malicious Code Variant Identification Based on Multiscale Feature Fusion CNNs

AIHGAT: A novel method of malware detection and homology analysis using assembly instruction heterogeneous graph

CNN‐ and GAN‐based classification of malicious code families: A code visualization approach

A Malicious Code Detection Method Based on FF-MICNN in the Internet of Things

Feature fusion-based malicious code detection with dual attention mechanism and BiLSTM

Crowdsourcing Malware Family Annotation: Joint Class-Determined Tag Extraction and Weakly-Tagged Sample Inference

Malware-on-the-Brain: Illuminating Malware Byte Codes with Images for Malware Classification

Malicious Code Detection based on Image Processing Using Deep Learning

A Novel Approach to Malicious Code Detection Using CNN-BiLSTM and Feature Fusion

Malicious Code Classification Method Based on Deep Residual Network and Hybrid Attention Mechanism for Edge Security

Large-Scale Malicious Software Classification With Fuzzified Features and Boosted Fuzzy Random Forest

Catch'em all: Classification of Rare, Prominent, and Novel Malware Families

Malicious Code Detection Method Based on Static Features and Ensemble Learning

High-resolution Image-based Malware Classification using Multiple Instance Learning