A malware classification method based on directed API call relationships.

Area of Science:

• Cybersecurity
• Machine Learning
• Network Security

Background:

• Increasingly complex network threats necessitate advanced malware detection.
• Existing methods using Application Programming Interface (API) sequences often ignore structural information.
• Current graph-based approaches may neglect the sequential nature of API interactions.

Purpose of the Study:

• To propose a novel malware classification method addressing limitations of existing techniques.
• To leverage directed relationships within API sequences for enhanced malware detection.
• To improve the accuracy and robustness of malware classification models.

Main Methods:

• Modeling API sequences as directed graphs with node attributes and directional relationships.
• Utilizing First-order and Second-order Graph Convolutional Networks (FSGCN) to approximate directed graph convolutional networks (DGCN).
• Transforming graph embeddings into grayscale images for classification with Convolutional Neural Networks (CNN) and employing Synthetic Minority Over-sampling Technique (SMOTE) for imbalanced datasets.

Main Results:

• The proposed FSGCN-based method effectively captures structural and sequential information from API sequences.
• Experimental results on real-world malware datasets demonstrate superior performance compared to traditional and existing graph-based methods.
• The approach shows significant effectiveness in classifying malware with improved accuracy.

Conclusions:

• The novel directed graph-based approach offers a significant advancement in malware classification.
• Integrating structural and sequential information via FSGCN enhances detection capabilities.
• This method provides a more robust and effective solution for combating sophisticated network threats.