FewM-HGCL : Few-Shot Malware Variants Detection Via Heterogeneous Graph Contrastive Learning

Liu, Chen; Li, Bo; Zhao, Jun; Zhen, Ziyang; Li, Xudong; Zhang, Qunshi

doi:10.1109/tdsc.2022.3216902

Cited by 9 publications

(4 citation statements)

References 0 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…This model achieved 91.56% accuracy on a private dataset. FewM-HGCL [62] introduces a self-supervised method based on contrastive learning for few-shot malware variants detection. The authors construct a heterogeneous graph with 5 types of entities: process, API, file, signature, and network.…”

Section: Entity Graph Approaches For Windows Malwarementioning

confidence: 99%

A Survey on Malware Detection with Graph Representation Learning

Bilot¹,

Madhoun²,

Agha³

et al. 2023

Preprint

View full text Add to dashboard Cite

Malware detection has become a major concern due to the increasing number and complexity of malware. Traditional detection methods based on signatures and heuristics are used for malware detection, but unfortunately, they suffer from poor generalization to unknown attacks and can be easily circumvented using obfuscation techniques. In recent years, Machine Learning (ML) and notably Deep Learning (DL) achieved impressive results in malware detection by learning useful representations from data and have become a solution preferred over traditional methods. More recently, the application of such techniques on graph-structured data has achieved state-of-the-art performance in various domains and demonstrates promising results in learning more robust representations from malware. Yet, no literature review focusing on graph-based deep learning for malware detection exists. In this survey, we provide an in-depth literature review to summarize and unify existing works under the common approaches and architectures. We notably demonstrate that Graph Neural Networks (GNNs) reach competitive results in learning robust embeddings from malware represented as expressive graph structures, leading to an efficient detection by downstream classifiers. This paper also reviews adversarial attacks that are utilized to fool graph-based detection methods. Challenges and future research directions are discussed at the end of the paper. CCS Concepts: • General and reference → Surveys and overviews; • Security and privacy → Malware and its mitigation; • Computing methodologies → Learning latent representations; Neural networks; Spectral methods.

show abstract

Section: Entity Graph Approaches For Windows Malwarementioning

confidence: 99%

A Survey on Malware Detection with Graph Representation Learning

Bilot¹,

Madhoun²,

Agha³

et al. 2023

Preprint

View full text Add to dashboard Cite

show abstract

“…Most GNN methods learn node-level representations through message passing mechanisms and have been successfully applied to many graph-related tasks in recent years, such as node classification [8,[14][15][16][17] and link prediction [18,19]. In addition, due to the specificity and large variability of some of the malware variants, the research on the few-shot learning and adversarial enhancement [47][48][49] has also been gradually implemented in recent years.…”

Section: Introductionmentioning

confidence: 99%

MalDMTP: A Multi-tier Pooling Method for Malware Detection based on Graph Classification

Kou,

Qiu,

Wang

et al. 2024

Preprint

View full text Add to dashboard Cite

With the development and adoption of cloud platforms in various fields, malware attacks have become a serious threat to the Internet cloud ecosystem. However, the pooling process of existing graph classification techniques for malware variant detection uses only a serial and single strategy, resulting in localized malicious behaviors of malware that may be overlooked. In this paper, we propose MalDMTP, a malware detection framework based on multilevel graph classification learning, which implements the graph pooling process for malware classification in parallel and performs graph instance-based discrimination. In particular, MalDMTP first constructs an API call graph based on results obtained from dynamic execution of malware. Then it combines multiple graph neural network learning strategies through multi-level pooling to learn the global importance of nodes in the pooled graph and extract node representations from multiple perspectives for heterogeneous graphs. After that, MalDMTP is aggregated into graph representations by the graph-level pooling function GMT based on a multi-head attention mechanism, which goes through a classifier in order to obtain malware prediction labels. Experimental results show that the proposed MalDMTP can achieve 96.53\% accuracy on the Alibaba cloud malware dataset, which improves 1.9\% ~ 7.6\% over the previous single-graph pooling methods on the graph classification task of malware detection.

show abstract

Section: Introductionmentioning

confidence: 99%

MalDMTP: A Multi-tier Pooling Method for Malware Detection based on Graph Classification

Kou,

Qiu,

Wang

et al. 2024

Mobile Netw Appl

View full text Add to dashboard Cite

With the development and adoption of cloud platforms in various fields, malware attacks have become a serious threat to the Internet cloud ecosystem. However, the pooling process of existing graph classification techniques for malware variant detection uses only a serial and single strategy, resulting in localized malicious behaviors of malware that may be overlooked. In this paper, we propose MalDMTP, a malware detection framework based on multilevel graph classification learning, which implements the graph pooling process for malware classification in parallel and performs graph instancebased discrimination. In particular, MalDMTP first constructs an API call graph based on results obtained from dynamic execution of malware. Then it combines multiple graph neural network learning strategies through multilevel pooling to learn the global importance of nodes in the pooled graph and extract node representations from multiple perspectives for heterogeneous graphs. After that, MalDMTP is aggregated into graph representations by the graph-level pooling function GMT based on a multi-head attention mechanism, which goes through a classifier in order to obtain malware prediction labels. Experimental results show that the proposed MalDMTP can achieve 96.53% accuracy on the Alibaba cloud malware dataset, which improves 1.9% 7.6% over the previous single-graph pooling methods on the graph classification task of malware detection.

show abstract

FewM-HGCL : Few-Shot Malware Variants Detection Via Heterogeneous Graph Contrastive Learning

Cited by 9 publications

References 0 publications

A Survey on Malware Detection with Graph Representation Learning

A Survey on Malware Detection with Graph Representation Learning

MalDMTP: A Multi-tier Pooling Method for Malware Detection based on Graph Classification

MalDMTP: A Multi-tier Pooling Method for Malware Detection based on Graph Classification

Contact Info

Product

Resources

About