Abstract:The traditional malware detection schemes based on specific signature give an unsatisfactory performance as disposing the previously unknown malware, so the general features of binary files should be explored to solve this problem. Recently, classification algorithms were employed successfully to choose the features in unknown malicious code, and most of the works use byte or operation code sequence n‐gram representation of the executables. However, these n‐gram representations are heavily dependent on the training data. In this paper, we present a graph‐based method to detect unknown malware. The function call graph of an executable, which includes the functions and the call relations between them, is selected as the representation of the executable in this method. The features are defined according to both the statistical information and the topology of the function call graph. They are extracted and processed through machine learning to classify unknown Portable Executable files. For the sake of fixed sum of the features, the graph‐based method can avoid so many features found in other methods. In our experiments, three types of malware datasets were tested, and as high as 96.8% accuracy can be achieved. Furthermore, it can achieve 92.1% accuracy when only 5% of the dataset is served as training set. Copyright © 2012 John Wiley & Sons, Ltd. To detect the unknown malware, the features of graph‐based method are predefined from function call graph of software, and then the rules are built with these features to classify an executable as the benign or the malware. The quantity and the contents of these features are independent of testing dataset, and this peculiarity enables our experiment results to nearly reflect the situation of unknown malware detection. The design can provide a high malware detection accuracy by using a small set of training set.

Embedding Vector Generation Based on Function Call Graph for Effective Malware Detection and Classification

Detecting Malware Using Graph Embedding and DNN

Classifying Malware Represented As Control Flow Graphs Using Deep Graph Convolutional Neural Network

Malware Classification by Learning Semantic and Structural Features of Control Flow Graphs.

Malware detection framework based on graph variational autoencoder extracted embeddings from API-call graphs

Malware Detection by Control-Flow Graph Level Representation Learning With Graph Isomorphism Network

Sequence Feature Extraction for Malware Family Analysis via Graph Neural Network

Malware Analysis Using Machine Learning and Deep Learning Techniques

Sequence-based malware detection using a single-bidirectional graph embedding and multi-task learning framework

An unknown malware detection scheme based on the features of graph

MalGNE: Enhancing the Performance and Efficiency of CFG-Based Malware Detector by Graph Node Embedding in Low Dimension Space

Intelligent Malware Detection Based on Graph Convolutional Network

Deepcg: Classifying Metamorphic Malware Through Deep Learning Of Call Graphs

MalGraph: Hierarchical Graph Neural Networks for Robust Windows Malware Detection

GSEDroid: GNN-based Android malware detection framework using lightweight semantic embedding

Malware Detection with Directed Cyclic Graph and Weight Merging

Graph embedding as a new approach for unknown malware detection

Malware Classification Based on GAF Visualization of Dynamic API Call Sequences

An Android Malware Detection Approach to Enhance Node Feature Differences in a Function Call Graph Based on GCNs

Guided Malware Sample Analysis based on Graph Neural Networks

Efficient Malware Detection Using Hybrid Approach of Transfer Learning and Generative Adversarial Examples with Image Representation