A Survey on Malware Detection with Graph Representation Learning

Abstract

Malware detection has become a major concern due to the increasing number and complexity of malware. Traditional detection methods based on signatures and heuristics are used for malware detection, but unfortunately, they suffer from poor generalization to unknown attacks and can be easily circumvented using obfuscation techniques. In recent years, Machine Learning (ML) and notably Deep Learning (DL) achieved impressive results in malware detection by learning useful representations from data and have become a solution preferred over traditional methods. More recently, the application of such techniques on graph-structured data has achieved state-of-the-art performance in various domains and demonstrates promising results in learning more robust representations from malware. Yet, no literature review focusing on graph-based deep learning for malware detection exists. In this survey, we provide an in-depth literature review to summarize and unify existing works under the common approaches and architectures. We notably demonstrate that Graph Neural Networks (GNNs) reach competitive results in learning robust embeddings from malware represented as expressive graph structures, leading to an efficient detection by downstream classifiers. This paper also reviews adversarial attacks that are utilized to fool graph-based detection methods. Challenges and future research directions are discussed at the end of the paper. CCS Concepts: • General and reference → Surveys and overviews; • Security and privacy → Malware and its mitigation; • Computing methodologies → Learning latent representations; Neural networks; Spectral methods.

An Evaluation of Current Malware Trends and Defense Techniques: A Scoping Review with Empirical Case Studies

“…Their concentration was on the detection techniques and detection frameworks. Bilot et al [14] conducted a survey on malware detection based on graph representation learning. They mainly summarized the graph-based deep learning for malware detection and adversarial attacks.…”

“…Formulae) The efficiency of an ML technique is usually measured using different metrics, as shown in Eqs. ( 5)− (14). A careful understanding of the metrics, the algorithms, and the data size, type and variety is key in selecting a metric for the evaluation of learning models.…”

ProvG-Searcher: A Graph Representation Learning Approach for Efficient Provenance Graph Search

“…One of the samples within each family has its corresponding provenance graph available in [61]. For the second sample in each family, we utilized a dynamic malware analysis platform 7 to analyze the actions performed by the sample on the system and generate the corresponding provenance graphs. We proceeded by testing whether the subgraph relationship between the pairs of isolated provenance graphs is preserved.…”

“…https://en.wikipedia.org/wiki/Subgraph_isomorphism_problem 2 In the cybersecurity context, graph representation learning has already demonstrated notable advancements and widespread application, particularly in the domain of vulnerability detection[7,13].…”