Malware Behavior Analysis Acceleration based on Graph Neural Networks
time
01:10 ~ 01:55
site
R2
The rapid growth of malicious binaries has left tons of damage to people and caused enormous data and financial loss. Unfortunately, the time for security experts to analyze unknown attack binaries does not increase as the number of samples grows exponentially. Therefore, accelerating the malware analysis process has become critical for the industry.
In this talk, we share our experiences with automated malware behavior analysis. We believe automatic identification of essential functions in binaries is the key to accelerating malicious samples. By leveraging graph neural networks and function embeddings, we developed an expert system to identify malicious samples and pinpoint possible directions for analyzing the samples.
We validate our research by using real-world samples targeted on the Windows OS. In addition to competitive detection performance (97.0% accuracy and 97.6% recall rate), our approach generates intuitive and easy-to-understand explanations by visualizing correlations of identified essential functions. We believe that an accurate detection model with well-designed explainers sheds light on automated program behavior analyses.
Steven Lin
Yi-Hsien Chen
Szu-Chun Huang
