ProcGCN: detecting malicious process in memory based on DGCNN.

Area of Science:

• Computer Science
• Cybersecurity
• Machine Learning

Background:

• Existing deep learning malware detection methods often rely on static byte features from process dumps, which can be altered once malware is in memory.
• Function call features offer a more robust representation of malware behavior compared to byte-level analysis.

Purpose of the Study:

• To propose and evaluate the ProcGCN model, a novel deep learning approach for detecting malicious processes in memory images.
• To leverage function call graph (FCG) representations for improved malware detection accuracy and speed.

Main Methods:

• The ProcGCN model, based on Deep Graph Convolutional Neural Network (DGCNN), was developed for memory forensics.
• Process dumps were extracted from memory images, and their Function Call Graphs (FCGs) were generated.
• Feature vectors for FCG nodes were created using a word bag model, and the FCGs were input into the ProcGCN for classification.

Main Results:

• The ProcGCN model achieved a high accuracy of 98.44% and an F1 score of 0.9828 on a public dataset.
• The model demonstrated superior performance compared to existing deep learning methods that use static features.
• ProcGCN exhibited faster detection speeds, highlighting its efficiency.

Conclusions:

• Function call features combined with graph representation learning are effective for memory forensics-based malware detection.
• The ProcGCN model offers a promising and efficient solution for identifying malicious processes in memory images.