Heterogeneous Graph Matching Networks for Unknown Malware Detection

Abstract

Information systems have widely been the target of malware attacks. Traditional signature-based malicious program detection algorithms can only detect known malware and are prone to evasion techniques such as binary obfuscation, while behaviorbased approaches highly rely on the malware training samples and incur prohibitively high training cost. To address the limitations of existing techniques, we propose MatchGNet, a heterogeneous Graph Matching Network model to learn the graph representation and similarity metric simultaneously based on the invariant graph modeling of the program's execution behaviors. We conduct a systematic evaluation of our model and show that it is accurate in detecting malicious program behavior and can help detect malware attacks with less false positives. MatchGNet outperforms the state-of-the-art algorithms in malware detection by generating 50% less false positives while keeping zero false negatives. * Work done during an internship at NEC Labs America. † The first two authors contributed equally. 1 www.accenture.com/us-en/insight-cost-of-cybercrime-2017 2 www.symantec.com/security-center/threat-report

WATSON: Abstracting Behaviors from Audit Logs via Aggregation of Contextual Semantics

“…Extensive literature exists on applying embedding techniques for other log analysis tasks. Such tasks include anomaly-based IDS [22], [25], [33], [52], [60], malware identification [18], [77], [78] and cyberattack evolution understanding [72]. Much prior work uses machine learning models such as neural networks, word embedding, and n-grams to embed logs into vectors.…”

Deep graph similarity learning: a survey

“…There are three main categories of deep graph similarity learning methods (see Fig. 1a): (1) graph embedding based methods, which apply graph embedding techniques to obtain node-level or graph-level representations and further use the representations for similarity learning (Tixier et al 2019;Nikolentzos et al 2017;Narayanan et al 2017;Atamna et al 2019;Wu et al 2018;Wang et al 2019a;Xu et al 2017;Liu et al 2019b); (2) graph neural network (GNN) based models, which are based on using GNNs for similarity learning, including GNN-CNNs (Bai et al 2018(Bai et al , 2019a, Siamese GNNs (Ktena et al 2018;Ma et al 2019;Liu et al 2019a;Wang et al 2019c;Chaudhuri et al 2019) and GNN-based graph matching networks (Li et al 2019;Ling et al 2019;Bai et al 2019b;Wang et al 2019b;Jiang et al 2019;Guo et al 2018); and (3) deep graph kernels that first map graphs into a new feature space, where kernel functions are defined for similarity learning on graph pairs, including sub-structure based deep kernels (Yanardag and Vishwanathan 2015) and deep neural Du et al 2019). In the meantime, different methods may use different types of features in the learning process.…”

“…In Ma et al (2019), a higher-order GNN model is developed to encode the community-structure of brain networks during the representation learning and leverage it for the similarity learning task on these brain networks. Some more examples from other domains include the GNN-based graph similarity predictive models introduced for chemical compound queries in computational chemistry (Bai et al 2019a), and the deep graph matching networks proposed for binary function similarity search and malware detection in computer security (Li et al 2019;Wang et al 2019c).…”

Attentional Graph Convolutional Networks for Knowledge Concept Recommendation in MOOCs in a Heterogeneous View

“…Wang et al [28] proposed DeepHGNN, an attentional heterogeneous graph neural network model to learn from the heterogeneous program behavior graph to guide the reidentification process. Wang et al [29] presented HAGNN, a Hierarchical Attentional Graph Neural Encoder and used it for program behavior Figure 7: The case study of ACKRec bases different metapaths. The blue labels denote the real next click, the green labels are the related knowledge concepts of the field of user student:2481307 interests in.…”