Spectral-Based Directed Graph Network for Malware Detection

Zhang, Zikai; Li, Yidong; Dong, Hairong; Gao, Honghao; Jin, Yi; Wang, Wei

doi:10.1109/tnse.2020.3024557

Cited by 17 publications

(8 citation statements)

References 50 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The sequences of dynamic graphs are identified as the event context to extract graph representations for prediction. SDGNet 36 is a novel graph convolutional network with 3 layer MDGCN to capture different features for malware detection. The proposed DEGCN capture temporal features with spatial changes with 2 layer GGRU.…”

Section: Methodsmentioning

confidence: 99%

“…After multiscaled API data modeling, we get multiscaled graph sequences. For each graph sequence, since the adjacency matrix (

{A}_{i}

) on each time slot is asymmetrical, we utilize the Weighted Graph Matrix Normalization Methods 36 to symmetrical matrices. After normalizing the adjacency matrix, we propose the DGCN model to extract the node representations on each time slot.…”

Section: Degcn Architecturementioning

confidence: 99%

See 1 more Smart Citation

Malware detection with dynamic evolving graph convolutional networks

Zhang

Wang

et al. 2022

Int J of Intelligent Sys

Self Cite

View full text Add to dashboard Cite

Malware detection is a vital task for cybersecurity. For malware dynamic behavior, threats come from a small number of Application Programming Interfaces (APIs) embedded in the API sequences, which are easily ignored or obfuscated in the detection process.Prior works proposed graph-based learning methods to solve this problem using API-level behavior relations.However, the malware detection is still challenging, due to the ignore of the temporal correlation between malicious behaviors. In this study, we model the software behaviors with multiscaled API graph sequences to represent API-level behaviors as well as graph-level temporal behavior correlations. We then propose a novel Dynamic Evolving Graph Convolutional Network (DEGCN) model to capture dynamic evolving pattern of both local API-level and global graph-level software behaviors. In particular, we first extract the API-level (node) representations to capture the directed graph representations for each time slot. We then propose a Graph-encoding-based Gate Recurrent Unit (GGRU) network to capture the graph-level evolving features and their evolving status. The graph features of different time slots and different graph scales are concatenated to detect whether the software is benign or malicious. Our evaluation with two public

show abstract

Section: Methodsmentioning

confidence: 99%

“…After multiscaled API data modeling, we get multiscaled graph sequences. For each graph sequence, since the adjacency matrix (

{A}_{i}

Section: Degcn Architecturementioning

confidence: 99%

Malware detection with dynamic evolving graph convolutional networks

Zhang

Wang

et al. 2022

Int J of Intelligent Sys

Self Cite

View full text Add to dashboard Cite

show abstract

“…Extant research efforts have mainly using Android permission to detect prevalent malware [12,17]. Zhu [23], implemented an Android malware detection scheme using Deep Neural Network using API calls.…”

Section: Related Workmentioning

confidence: 99%

“…Extant research efforts have mainly using Android permission to detect prevalent malware [12, 17]. Zhu et al.…”

Section: Related Workmentioning

confidence: 99%

See 1 more Smart Citation

MalDroid: Secure DL‐enabled intelligent malware detection framework

et al. 2021

View full text Add to dashboard Cite

Nowadays, smartphones are provided with an abundance of capabilities. During the last decade, the availability of smartphone users and online mobile payment services and applications have substantially grown. Besides, the Android infotainment market is exponentially growing and thus potentially becoming a primary target for cyber adversaries and attackers. Likewise, varied Android vulnerability exploitation and targeted pervasive malware sophisticated attacks are also becoming a hot spot for both industry and academia. The authors present a secure by design efficient and intelligent Android detection framework against prevalent, sophisticated and persistent malware threats and attacks. A novel and highly proficient Cuda-enabled multi-class malware threat detection and identification Deep Learning (DL)-driven mechanism that leverages ConvLSTM2D and CNN has been proposed. The devised approach has been extensively evaluated on publicly available state-of-the-art datasets of Android applications (i.e. Android Malware Dataset (AMD), Androzoo). Standard and extended assessment metrics have been employed to thoroughly evaluate the proposed technique. Moreover, the performance of the proposed algorithm has been verified both with the constructed hybrid DL-driven algorithms and current benchmarks. Additionally, the proposed scheme is cross validated to explicitly show unbiased results.

show abstract