.png){kind=icon}
Return
DawnGNN: Documentation augmented windows malware detection using graph neural network
.png){kind=icon}
PRE
AI
DOI：10.1016/j.cose.2024.103788.png)
.png){kind=icon}
Original request for help.png){kind=icon}
Share.png){kind=icon}
Save
Abstract
En 中文
Application Program Interface (API) calls are widely used in dynamic Windows malware analysis to characterize the run-time behavior of malware. Researchers have proposed various approaches to mine semantic information from API calls to improve the performance of malware analysis. However, with increasingly sophisticated malware, the exploration of new semantic dimensions for API calls is never-ending. In this paper, we find that the official Windows API documentation is an unexplored information source in malware detection. Therefore, we propose a novel documentation -augmented Windows malware detection framework DawnGNN using the pre -trained semantic enhanced mechanism and graph neural network. First, it converts the API sequences into API graphs for further contextual information extraction. Next, we crawl API documentation from the official website and employ the pre -trained Bidirectional Encoder Representations from Transformers (BERT) model to encode functionality descriptions as API embeddings. Finally, it feeds the API graphs with API node attributes into the Graph Attention Network (GAT) classifier to perform Windows malware detection. Moreover, we verify the effectiveness of DawnGNN on three public datasets. Experimental results demonstrate the effectiveness of DawnGNN. Semantic information from the official API documentation is promising in the Windows malware detection domain.
Keywords:
Windows malware detection
Graph neural network
BERT-based embedding
Dynamic API call
Journal
C
IF:
5.4
Papers:
4.6K
Citations:
1.4W
Organization
Cited Papers
ShareSaveDMalNet: Dynamic malware analysis based on API feature engineering and graph learning.png)
COMPUTERS & SECURITY
COMPUTERS & SECURITYIF5.4
PREAI
ShareSaveShareSaveShareSave
Challenge of Ziehl-Neelsen stain for Basidiobolomycosis diagnosis in Indonesia: A unique case report
OAAI
OAAIShareSaveGDroid: Android malware detection and classification with graph convolutional networkCOMPUTERS & SECURITY
COMPUTERS & SECURITYIF5.4
PREAI
ShareSaveA novel deep framework for dynamic malware detection based on API sequence intrinsic featuresCOMPUTERS & SECURITY
COMPUTERS & SECURITYIF5.4
PREAI
ShareSaveENIMANAL: Augmented cross-architecture IoT malware analysis using graph neural networksCOMPUTERS & SECURITY
COMPUTERS & SECURITYIF5.4
PREAI
ShareSave
View more