Abstract:At present, the trend of familiarization of malicious code is becoming more and more obvious, and the research on the homology of malware (the classification of malicious code family) is of great significance for maintaining network security. In order to better express the overall characteristics of malicious code and improve the effect of detection and homology analysis, this paper proposes a method for detection and homology analysis of malware based on heterogeneous graphs of assembly instructions (AIHGAT). We take the assembly instructions of malicious families as the research object and analyze the importance and correlation of assembly instructions of different malicious families. The malware detection and homology analysis are carried out in three aspects: feature extraction, feature preprocessing, and model construction. In the feature extraction of malicious code, in order to alleviate the problem that it is difficult to extract static features of malicious samples that contain countermeasures such as packing and obfuscation, we obtain binary files from dynamic memory through sandbox and then, analyze its assembly instruction set. In feature preprocessing, we divide the assembly instructions into N-tuples and construct a heterogeneous graph based on assembly instructions according to the internal correlation of the gene sequence composed of the assembly N-grams features. Finally, in terms of model construction, we analyze the homology determination effect of the traditional graph neural network and construct the Graph Attention Network based on residual connection named ResGAT to analyze the homology of malicious code. The experimental results show that the ResGAT can gather the core characteristics of malicious families and enhance the ability to recognize malicious family variants. Our model has an accuracy rate of 98.83%, which is better than traditional machine learning detection methods, and can effectively determine the homology of malicious code families.

A malicious code family classification method based on self-attention mechanism

Few-Shot Malware Classification via Attention-Based Transductive Learning Network

CNN‐ and GAN‐based classification of malicious code families: A code visualization approach

Malicious Code Classification Method Based on Deep Residual Network and Hybrid Attention Mechanism for Edge Security

Self-attention based convolutional-LSTM for android malware detection using network traffics grayscale image

A Malicious Code Detection Method Based on Stacked Depthwise Separable Convolutions and Attention Mechanism

An Efficient Malicious Code Detection System Based on Convolutional Neural Networks

Feature fusion-based malicious code detection with dual attention mechanism and BiLSTM

Detection of Malicious Code Variants Based on Deep Learning

Image-Based Malware Classification Method with the AlexNet Convolutional Neural Network Model

Task-Aware Meta Learning-based Siamese Neural Network for Classifying Obfuscated Malware

Malware Analysis Using Machine Learning and Deep Learning Techniques

A Hybrid Analysis-Based Approach to Android Malware Family Classification

A Hybrid Deep Learning Model for Malicious Behavior Detection

Malware Detected and Tell MeWhy: An Verifiable Malware Detection Model with Graph Metric Learning

FamDroid: Learning-Based Android Malware Family Classification Using Static Analysis

Android Malware Detection Based on a Novel Mixed Bytecode Image Combined with Attention Mechanism

A Malicious Code Detection Method Based on FF-MICNN in the Internet of Things

Malicious Code Detection Method Based on Static Features and Ensemble Learning

Image-Based Malware Classification Using VGG19 Network and Spatial Convolutional Attention

AIHGAT: A novel method of malware detection and homology analysis using assembly instruction heterogeneous graph