Abstract:At present, the trend of familiarization of malicious code is becoming more and more obvious, and the research on the homology of malware (the classification of malicious code family) is of great significance for maintaining network security. In order to better express the overall characteristics of malicious code and improve the effect of detection and homology analysis, this paper proposes a method for detection and homology analysis of malware based on heterogeneous graphs of assembly instructions (AIHGAT). We take the assembly instructions of malicious families as the research object and analyze the importance and correlation of assembly instructions of different malicious families. The malware detection and homology analysis are carried out in three aspects: feature extraction, feature preprocessing, and model construction. In the feature extraction of malicious code, in order to alleviate the problem that it is difficult to extract static features of malicious samples that contain countermeasures such as packing and obfuscation, we obtain binary files from dynamic memory through sandbox and then, analyze its assembly instruction set. In feature preprocessing, we divide the assembly instructions into N-tuples and construct a heterogeneous graph based on assembly instructions according to the internal correlation of the gene sequence composed of the assembly N-grams features. Finally, in terms of model construction, we analyze the homology determination effect of the traditional graph neural network and construct the Graph Attention Network based on residual connection named ResGAT to analyze the homology of malicious code. The experimental results show that the ResGAT can gather the core characteristics of malicious families and enhance the ability to recognize malicious family variants. Our model has an accuracy rate of 98.83%, which is better than traditional machine learning detection methods, and can effectively determine the homology of malicious code families.

MAlign: Explainable static raw-byte based malware family classification using sequence alignment

MALIGN: Explainable Static Raw-byte Based Malware Family Classification using Sequence Alignment

A Hybrid Analysis-Based Approach to Android Malware Family Classification

FamDroid: Learning-Based Android Malware Family Classification Using Static Analysis

Catch'em all: Classification of Rare, Prominent, and Novel Malware Families

Malware Analysis Using Machine Learning and Deep Learning Techniques

A novel few-shot malware classification approach for unknown family recognition with multi-prototype modeling

Deep hybrid approach with sequential feature extraction and classification for robust malware detection

MalwareDNA: Simultaneous Classification of Malware, Malware Families, and Novel Malware

Efficient and Robust Malware Detection Based on Control Flow Traces Using Deep Neural Networks

Bio-inspired data mining: Treating malware signatures as biosequences

Malytics: A Malware Detection Scheme

RecMaL: Rectify the malware family label via hybrid analysis

Task-Aware Meta Learning-based Siamese Neural Network for Classifying Obfuscated Malware

AIHGAT: A novel method of malware detection and homology analysis using assembly instruction heterogeneous graph

Unveiling Zeus

Malware Lineage in the Wild

A Novel Approach to Detect Malware Based on API Call Sequence Analysis

Detecting Android Malware and Classifying Its Families in Large-scale Datasets

Android Malware Family Labeling: Perspectives from the Industry

Decoding the Secrets of Machine Learning in Malware Classification: A Deep Dive into Datasets, Feature Extraction, and Model Performance