Abstract:At present, the trend of familiarization of malicious code is becoming more and more obvious, and the research on the homology of malware (the classification of malicious code family) is of great significance for maintaining network security. In order to better express the overall characteristics of malicious code and improve the effect of detection and homology analysis, this paper proposes a method for detection and homology analysis of malware based on heterogeneous graphs of assembly instructions (AIHGAT). We take the assembly instructions of malicious families as the research object and analyze the importance and correlation of assembly instructions of different malicious families. The malware detection and homology analysis are carried out in three aspects: feature extraction, feature preprocessing, and model construction. In the feature extraction of malicious code, in order to alleviate the problem that it is difficult to extract static features of malicious samples that contain countermeasures such as packing and obfuscation, we obtain binary files from dynamic memory through sandbox and then, analyze its assembly instruction set. In feature preprocessing, we divide the assembly instructions into N-tuples and construct a heterogeneous graph based on assembly instructions according to the internal correlation of the gene sequence composed of the assembly N-grams features. Finally, in terms of model construction, we analyze the homology determination effect of the traditional graph neural network and construct the Graph Attention Network based on residual connection named ResGAT to analyze the homology of malicious code. The experimental results show that the ResGAT can gather the core characteristics of malicious families and enhance the ability to recognize malicious family variants. Our model has an accuracy rate of 98.83%, which is better than traditional machine learning detection methods, and can effectively determine the homology of malicious code families.

Homology Judgment Technology of Malicious Code

A malware detection framework based on kolmogorov complexity

Visualization Feature and CNN Based Homology Classification of Malicious Code

Survey on Malicious Code Intelligent Detection Techniques

K-Means Clustering Analysis Based On Adaptive Weights For Malicious Code Detection

Malware detection technologies based on software intermediate code

Malicious Code Detection Based on Software Fingerprint

AIHGAT: A novel method of malware detection and homology analysis using assembly instruction heterogeneous graph

How To Automatically Identify The Homology Of Different Malware?

Overeview on Malicious Code Shelling

A FEATURE SELECTION AND MODELLING METHOD FOR MALICIOUS CODE

Network-based Malcode Detection Technology

Automatic Malicious Code Classification System through Static Analysis Using Machine Learning

Malicious Code Detection Using LLM

Behavior-Based Proactive Detection of Unknown Malicious Codes

An Automatic MaIware HomoIogy Identification Method Based on CaIIing Habits

AMCAS: an Automatic Malicious Code Analysis System

Malicious Code Detection Method Based on Static Features and Ensemble Learning

Method for Detecting the Obfuscated Malicious Code Based on Behavior Connection

An Effective Cloud-Based Active Defense System Against Malicious Codes

An Open Source Software Defect Detection Technique Based on Homology Detection and Pre-identification Vulnerabilitys