.png){kind=icon}
返回
Evolving malware detection through instant dynamic graph inverse reinforcement learning
.png){kind=icon}
PRE
AI
DOI：10.1016/j.knosys.2024.111991.png)
.png){kind=icon}
原文求助.png){kind=icon}
分享.png){kind=icon}
收藏
摘要
En 中文
The rapid development and increasing evolution of malware necessitate novel defensive techniques with high accuracy and minimal false positives to safeguard information systems against potential threats. Unfortunately, current malware detection methods, primarily relying on deep learning to identify malicious fingerprints from extensive training sets, prove ineffective against few-shot and evolving malware variants. To address these challenges, this paper introduces MalIRL, which designs a model-free inverse reinforcement learning (IRL) mechanism to automatically capture the evolving attack intent of malware. Specifically, MalIRL explores six representative categories of malware actions and employs sliding windows to organically divide the massive malware execution event stream into multiple attack stages, achieving a reduced action space and state space. To model dynamic malicious environments, MalIRL proposes an instant dynamic heterogeneous graph representation learning technique. This technique learns state representations of different malware attack stages, enhancing detection accuracy and efficiency by incrementally capturing the newly added contextual semantics of diverse malware entities and relations. In experiments with three real-world malware datasets, MalIRL surpasses existing state-of-the-art methods, particularly in few-shot malware detection scenarios, MalIRL exhibits performance benefits of up to 18.9%.
Keyword:
Malware detection
Inverse reinforcement learning
Dynamic graph representation learning
Markov decision process
期刊
K
IF:
7.6
论文数:
1.3W
被引数:
4.5W
机构
引用论文
A feature-hybrid malware variants detection using CNN based opcode embedding and BPNN based API embedding使用基于CNN的操作码嵌入和基于BPNN的API嵌入的特征混合恶意软件变体检测.png)
COMPUTERS & SECURITY
COMPUTERS & SECURITYIF5.4
PREAI
分享收藏
A few-shot malware classification approach for unknown family recognition using malware feature visualizationCOMPUTERS & SECURITY
OAAI
COMPUTERS & SECURITYIF5.4
OAAI分享收藏MCTVD: A malware classification method based on three-channel visualization and deep learningCOMPUTERS & SECURITY
COMPUTERS & SECURITYIF5.4
PREAI
分享收藏Optimal Graph Transformer Viterbi knowledge inference network for more successful visual navigation用于更成功的视觉导航的最佳图形变压器Viterbi知识推理网络
PREAI
分享收藏
查看更多内容