BejaGNN: behavior-based Java malware detection via graph neural network.

Area of Science:

• Computer Science
• Cybersecurity
• Machine Learning

Background:

• Java malware poses a significant cross-platform threat due to Java's widespread enterprise use.
• Dynamic analysis methods for Java malware detection suffer from limited code coverage and poor efficiency.
• Static analysis offers a promising alternative for efficient malware detection by extracting rich features.

Purpose of the Study:

• To develop a novel behavior-based Java malware detection method using graph learning.
• To enhance the accuracy and efficiency of Java malware detection through static analysis and neural networks.
• To address the limitations of existing dynamic analysis techniques in identifying Java malware.

Main Methods:

• Extracted Inter-procedural Control Flow Graphs (ICFGs) from Java program files using static analysis.
• Pruned ICFGs to eliminate noisy instructions and refined graph structures.
• Applied word embedding techniques to learn semantic representations of Java bytecode instructions.
• Developed a Graph Neural Network (GNN) classifier, named BejaGNN, for maliciousness determination.

Main Results:

• BejaGNN achieved a high F1 score of 98.8% on a public Java bytecode benchmark.
• The proposed method demonstrated superior performance compared to existing Java malware detection approaches.
• Validated the effectiveness of graph neural networks in the domain of Java malware detection.

Conclusions:

• BejaGNN offers a promising and effective approach for behavior-based Java malware detection.
• Graph neural networks show significant potential for advancing static analysis-based malware identification.
• The method provides a robust solution for combating the growing threat of Java malware.