<p>Malware detection remains a critical challenge in cybersecurity due to the increasing sophistication of malicious software. In this work, we propose a novel graph-based Deep Learning (DL) pipeline for analyzing Portable Executable (PE) files to detect and classify malware. Our approach begins by disassembling PE files to extract structural and relational information, such as control flow and function call dependencies, which are represented as graphs. These graphs are serialized into Graph Modeling Language (GML) files, enabling efficient storage and processing. To capture the intrinsic properties of malware, we introduce a hybrid Graph Neural Network (GNN) architecture combining Graph Convolutional Networks (GCN) for global graph structure learning, Graph Attention Networks (GAT) for dynamic attention-based node weighting, and Graph Isomorphism Networks (GIN) for robust graph-level feature extraction. The extracted features are subsequently used to train Deep Neural Network (DNN) classifiers. Experimental results on the Dike, EMBER, and BODMAS datasets highlight the robustness and accuracy of this methodology in identifying malware, with the hybrid GCN, GAT, and GIN architecture outperforming individual models in feature extraction and classification task. To address the critical threat of evasive techniques, we further investigate the model’s resilience against adversarial attacks. Crucially, by implementing Projected Gradient Descent (PGD) adversarial training, our robust model demonstrates significantly improved resilience to gradient-based attacks (FGSM and PGD) compared to a baseline model. This highlights the effectiveness of our methodology in building a defense that is robust against common malware obfuscation techniques.</p>

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

Multi-branch graph neural network for robust malware detection

  • Dhiya Eddine Abid,
  • Abdelkader Ghazli,
  • Mourad Bouache

摘要

Malware detection remains a critical challenge in cybersecurity due to the increasing sophistication of malicious software. In this work, we propose a novel graph-based Deep Learning (DL) pipeline for analyzing Portable Executable (PE) files to detect and classify malware. Our approach begins by disassembling PE files to extract structural and relational information, such as control flow and function call dependencies, which are represented as graphs. These graphs are serialized into Graph Modeling Language (GML) files, enabling efficient storage and processing. To capture the intrinsic properties of malware, we introduce a hybrid Graph Neural Network (GNN) architecture combining Graph Convolutional Networks (GCN) for global graph structure learning, Graph Attention Networks (GAT) for dynamic attention-based node weighting, and Graph Isomorphism Networks (GIN) for robust graph-level feature extraction. The extracted features are subsequently used to train Deep Neural Network (DNN) classifiers. Experimental results on the Dike, EMBER, and BODMAS datasets highlight the robustness and accuracy of this methodology in identifying malware, with the hybrid GCN, GAT, and GIN architecture outperforming individual models in feature extraction and classification task. To address the critical threat of evasive techniques, we further investigate the model’s resilience against adversarial attacks. Crucially, by implementing Projected Gradient Descent (PGD) adversarial training, our robust model demonstrates significantly improved resilience to gradient-based attacks (FGSM and PGD) compared to a baseline model. This highlights the effectiveness of our methodology in building a defense that is robust against common malware obfuscation techniques.