The polymorphic nature of malware makes it challenging to identify, especially when employing hash-based detection approaches, making malware detection an intriguing study topic. In contrast to image-based methods, a graph-based method was employed in this study to extract control flow graphs from Android APK binaries. We use a method that combines XGBoost, a common machine learning model, with Inferential SIR-GN for Graph representation, a novel graph representation learning method that preserves graph structural similarities, to handle the resulting graph. The method is then used on MALNET, an open cybersecurity database containing 1,262,024 million Android APK binary files in total, with 47 kinds and 696 families. The experimental findings show that, in terms of detection accuracy, our graph-based technique surpasses the image-based method.
1. Introduction
Malicious cyber activity’s economic effects on the US economy are difficult to estimate, however,
these assaults cost the economy between $57 billion to $109 billion in 2016 [
This type of attacks is achievable and successful due to malware apps. Detecting such applications can be a challenging process, however, there exist two popular methods for malware analysis: static code analysis and dynamic code analysis. The static analysis searches for malicious patterns by disassembling the code and studying the executable’s control flow without executing the code. On the other hand, the code is executed virtually in the case of dynamic analysis, this approach is behaviorbased, and therefore the key methods may be discovered.
Although static analysis provides comprehensive coverage, it still suffers occasionally from code
obfuscation. Before analysis, the executable must be unpacked and encrypted, but regardless of that,
the analysis still can be vulnerable to difficulties of intractable complexity. On the other hand, the
executable does not need to be neither unpacked nor encrypted in the case of the dynamic analysis.
However, it is unfortunate that dynamic analysis can still be time-consuming and resource-intensive, as
mentioned in [
On the other hand, static analysis is successful in the context of Android OS, and graph control flow is extractable. Furthermore, similar to the image, once the graphs are created, they do not require any additional engineering processes because the well-established field of graph representation learning develops the feature representing the graph automatically.
Graph representation learning techniques are promoting the advancement of representation learning
as they have been adopted by various scientific domains. Structured data is encoded by these techniques
into low-dimensional space for several essential downstream tasks (for example, toxic molecule
detection, community clustering, and malware detection) [
Graph representation learning approaches are classified as methods that preserve node connectivity
information and methods that preserve node structure information. Despite, the existence of many
works that concentrate on maintaining node connections, just few works aim at maintaining node
structures. For many real-world applications, properly encoding node structure information is critical
since it has been proven that this information may be used to solve numerous problems where
connectivity-based approaches fail [
In this study, a graph representation learning method is used namely the Inferential Structural Iterative Representation Learning Approach for Graph Nodes (Inferential SIR-GN). Which is a graph representation learning approach where theoretically the conservation of graph structural similarities is ensured. In order to identify malware, classify Android APK types, and classify Android APK families, our technique, Inferential SIR-GN, is combined with XGBoost (i.e., a common classification machine learning model).
This technique is then applied to MALNET-TINY, which is a subset of MALNET a public dataset
of 1,262,024 million Android APK files divided into 47 kinds and 696 families. MALNET is one of
the finest publicly accessible repositories since it is larger and includes more types than others like
[
Our investigation on MALNET-TINY demonstrates that for malware classification and detection,
Inferential SIR-GN is frequently superior or at worst similar to ResNet (i.e., a neural network for
recognizing images) [
MALNET is the biggest cybersecurity dataset ever released; it comprises 1,262,024 Android APK
files comprising 47 malware kinds and 696 malware families. The imbalance ratios for both types and
families are 7,827 × and 16,901 ×, respectively. We will be dealing with MALNET-TINY in this
work; as displayed in Figure. 2, both type and family have distributions with imbalance ratios of 154 ×
and 908 ×. MALNET-TINY involves 61,201 training, 8,743 validation, and 17,486 tests of Android
APK files for type-level classification experiments by deleting MALNET’s four major kinds.
MALNET-TINY’s purpose is to enable users to quickly prototype new concepts by requiring only a
fraction of the time required to train a new model [
Scale. MALNET-TINY includes 87,430 Android APK files from 43 malware categories and 246 malware families. MALNET-TINY takes up more than 35 GB of disk space in edge list format. Descriptive data on the number of nodes, edges, and average degree of MALNET-TINY are provided in Figure. 4.
Hierarchy. Using the Euphony [
Diversity. MALNET-TINY has 43 types, 246 families, and graphs with 17,588 nodes, 40,105 edges, and 2 degrees on average. Figure. 2 depicts a type and family distribution with ratios of 154 × and 908 ×. The graphs have a long-tailed distribution, which makes classification challenging because ignoring unusual events is likely to result in high-severity mistakes during testing. When there are disparities in the scales of the input variables, the difficulty of the problem being represented increases. The distribution of hundreds or thousands of types and families presented in Figure. 2 might result in a model that learns huge weight values, which is an undesirable behavior.
Imbalance. Long-tail distribution models tend to favor the majority class, resulting in poor
generalization performance for uncommon classes. Traditionally, the class imbalance is resolved by
resampling the data (under-sampling, over-sampling) [
The fundamental shortcoming of most existing under-sampling algorithms is that their data sampling
strategies are heuristic-based and unaffected by the classifier and evaluation measure utilized. As a
result, during data sampling, they may ignore informative occurrences for the classifier [
We will not use one-sided selection, which aims to intelligently under-sample the majority class by deleting majority class cases that are considered noise. In order to anticipate malware development, we will combine malware minority samples with “benign” ones.
For the case of the MALNET-TINY dataset the Figure. 4 displays the MALNET-TINY’s graph statistics. Such that for every type included in the dataset, the Figure presents some statistics: • # : Number of graphs included in the following type. • # : the number of families included in the following type. • Nodes: these represent the Min, Max, Mean, and STD number of the node. • Edges: these model the Min, Max, Mean, and STD number of edges involved in graphs of this malware type. • Avg. Degrees: finally, this metric provides information about the Min, Max, Mean, and STD average degrees of the node.
As presented in the Figure. 4, the MALNET-TINY dataset contains over 80 software images across a hierarchy of 43 types. We can understand that this dataset is a reduction of the original MALNET dataset, this reduction is produced to allow researchers to rapidly prototype new ideas since it requires only a fraction of the time needed to train a new model.
An approach for developing a malware classifier that is resistant to malware polymorphism is proposed. The process involves four parts: • Extraction of the structural vectorial representation for each node in a graph describing an Android application using Inferential SIR-GN. • Generation of the structural pseudo-adjacency matrix by using the vectorial representations of all the nodes of a certain graph representing an Android application. The graph is represented by the structural pseudo-adjacency matrix, followed by the Android app. • To build a potentially polymorphic variant of the virus, we combine the malware’s structural pseudo-adjacency matrix with the matrix of the benign Android app. • Train a random forest algorithm to identify and categorize malware using the representations of the Android applications (benign and malware) and the representations of the hypothetical polymorphic form of the malware.
The Inferential SIR-GN, the structural pseudo-adjacency matrix, and the matrix combination for possible polymorphic combinations are all described below. 3.1.
Layne and Serra [
The first difference between inferential SIR-GN and the standard model is that at the conclusion of each iteration, each node’s structural description is concatenated into a bigger representation that reflects the evolution of the structural information via deeper neighborhood exploration. A Principle Component Analysis (PCA) is employed after the final iteration to prevent information erosion as the representation size rises. The final representation is reduced to a hyperparameter-specified size. A node’s initial representation in a directed graph begins with two vectors of size , one providing the node’s in-degree and the other holding its out-degree. Before clustering, these two vectors are concatenated. Clustering of this bigger node vector is conducted at each iteration, then by aggregation of the neighbors. In the case of directed data, aggregation is performed independently for a node’s inneighbors and out-neighbors into two intermediate vectors, which are then concatenated together for the following iteration. The proposed model’s inferential capacity is achieved by pre-training the KMeans and scalers. For each iteration, we employ a new KMeans and Scaler for each depth of investigation, in addition to the PCA model that will be used to build the final node representation. Each model is pre-trained on random graphs and saved for later use in inference. At inference time, we employ the pre-trained models to perform repeated normalizing, clustering, and aggregation, and the PCA fit during training is used to construct the final node representations. This reduces inference time significantly, and the same pre-trained model may be utilized on a range of different data sources. Layne and Serra prove that, along with a full method and description of the model’s temporal complexity. 3.2.
A process for creating a unique graph representation approach is provided by [
These node representations are especially utilized to train a final scalar and KMeans model that
clusters the complete graph data at inference time. This final KMeans is fitted using the concatenated
iterative node representations compressed by PCA, as opposed to the incremental KMeans, which only
observes the node representation or aggregation for the current level of depth being examined. During
inference, the nodes of the target graph are embedded as stated above, then grouped again using the
KMeans pre-trained on the entire graph data. As noted previously, the distances to the cluster centroids
are converted into probabilities of cluster membership. Nevertheless, the aggregation approach for
graph representation differs significantly from that for nodes. Graph representations are frequently
produced by summing or mean-pooling node representations. A novel approach for node pooling is
provided by Layne and Serra [
We build a process to construct a polymorphic variant of existing malware utilizing the structural pseudo-adjacency matrix that represents each Android application. ( ) represents the structural pseudo-adjacency matrix of the network of an Android application . For each Android virus , the process looks among the benign apps for the application that has ( ) closest in terms of Euclidean distance to ( ). The -nearest neighbor technique (KNN) is used to compute the closest benign application quickly. Given the Android malware a and the closet innocuous application m, the following weighted mean of the two representations yields a polymorphic representation of :
= 0.8 ∙ ( ) + 0.2 ∙ ( ) (1)
Weights are used to subtly alter the virus representation ( ). Then, we develop a polymorphic representation for each malware, and all of the polymorphic representations are employed in the training of the classification model, in this case, a random forest, to make the classification model resistant to polymorphic changes in malware applications.
The latter one is among the most relevant innovations of our proposed research, positioning itself as a noticeable contribution to the actual research. Polymorphic analysis, in fact, is critical for malware detection.
MALNET-TINY 5k is divided into 3,500 training, 500 validation, and 1,000 graphs for type-level
classification tests. MALNET-TINY is composed of 61,201 training graphs, 8,743 validation graphs,
and 17,486 graphs. For type-level classification experiments and evolution prediction classification,
we split these datasets. In this investigation, a comparison is made against Freitas, Duggal, and Chau
[
The results for the SIR-GN graph representation approach [
on an
( )
Core( ) 7 − Our 7700 • • • .
The following datasets are used:
MALNET-TINY 5k each of dataset’s kinds (Addisplay, Adware, Benign, Downloader, and MALNET-TINY 61K For type-level classification tests, there are 61,201 training, 8,743 MALNET-TINY 81K For type level classification experiments and evolution prediction, there are 81,201 training, 8,743 validation, and 27,486 test graphs.
The results for the MALNET-TINY dataset using macro-F1, macro-precision, and macro-recall on random splits of 61,201 training graphs, 8,743 validation graphs, and 17,486 test graphs are shown in precision of 0.672, and a macro-recall of 0.646, whereas we obtain a macro-F1 score of 0.718, a macroprecision of 0.729, and a macro-recall of 0.794. Using the SIR-GN algorithm increases the classifier’s performance.
Figure. 6 displays the findings for the MALNET-TINY 5k dataset with macro-F1, macro-precision, and macro-recall performed on random splits of 3,500 training graphs, 500 validation graphs, and 1000 test graphs. We achieved a macro-F1 score of 0.916, a macro-precision of 0.917, and a macro-recall of 0.915 for the random split.
As reported in Figure. 7, accuracy scores are presented for numerous graph-based approaches [
In the experiments presented in Figure. 8, we compare MALNET-TINY against benign malware types to create a score based on a random split. The macro-F1 score, macro-precision, and macro-recall for random and temporal splits are presented in this Figure. The Figure also displays results for a temporal split in which the training dates ranged from 2012 to 2019, while the test dates ranged from 2020 to 2021. We obtained a macro-F1 score of 0.725, a macro-precision of 0.739, and a macro-recall of 0.807 for the temporal split and type categorization. When we use evolution prediction, we achieve a 0.741 vs 0.725 performance improvement for a macro-F1 score.
In this study, MALNET and emphasized graph representation learning approaches that have evolved across various scientific domains were presented, these methods are driving the evolution of representation learning techniques. For several essential downstream tasks, graph representation learning approaches compress structured information into low-dimensional space. We suggested an approach for developing a malware classifier that is resistant to malware polymorphism. Given a graph representing an Android application, Inferential SIR-GN was used to extract the structural vectorial representation for each node within the network. In this study, we trained a model to recognize and classify malware using representations of Android applications (both benign and malicious) and possibly polymorphic versions of the malware.
In the investigation, we go on with the experimental settings and the empirical results. SIR-GN graph representation technique results are presented. According to our findings, Malware applications are harmful and cause significant damage. As a result, malware identification and categorization are critical for its mitigation. Transforming binary executables into pictures is a practical and accurate method for using image neural networks to identify and categorize malware. In contrast to the Imagebased technique, we proposed in this paper a procedure based on control flow graph, structural graph representation learning, and XGBoost. In terms of malware classification, such a process was evaluated on MALNET and outperformed the image-based method utilizing the neural network ResNet. Moreover, we created a process to generate a polymorphic version of an existing malware program utilizing the structural pseudo-adjacency matrix representing each Android application in order to improve the training phase and classification performances.
Future work is mainly oriented to embed performance in our framework, as required by modern big data trends (e.g., [57-60]).
[54] T.N. Kipf, M. Welling, “Semi-Supervised Classification with Graph Convolutional Networks”, in: 5th International Conference on Learning Representations, 2017 [55] A. Tsitsulin, M. Munkhoeva, B. Perozzi, “Just Slaq When You Approximate: Accurate Spectral
Distances for Web-Scale Graphs”, in: 2020 Web Conference, 2020, pp. 2697-2703 [56] T.H. Schulz, P. Welke, “On the Necessity of Graph Kernel Baselines”, in: European Conference on Machine Learning and Principles and Practice of Knowledge Discovery in Databases - Graph Embedding and Mining Workshop, 2019, art. 6 [57] A. Bonifati, A. Cuzzocrea, “Storing and retrieving XPath fragments in structured P2P networks”,
Data Knowl. Eng. 59.2, (2006) pp. 247-269 [58] A. Cuzzocrea, D. Saccà, P. Serafino, “A Hierarchy-Driven Compression Technique for Advanced OLAP Visualization of Multidimensional Data Cubes”, in: 2006 DaWaK International Conference, 2006, pp. 106-119 [59] A. Cuzzocrea, F. Furfaro, G.M. Mazzeo, D. Saccà, “A Grid Framework for Approximate Aggregate Query Answering on Summarized Sensor Network Readings”, in: 2004 OTM International Workshops, 2004, pp. 144-153 [60] M. Kumar, “Scalable malware detection system using big data and distributed machine learning approach”, Soft Comput. 26.8, pp. 3987-4003 (2022)