BejaGNN:通过图形神经网络进行基于行为的Java恶意软件检测
Pengbin Feng1, Li Yang2, Di Lu2
1School of Cyber Engineering, Xidian University, Xi'an, 710071 Shaanxi China.
The Journal of supercomputing
|June 26, 2023
概括
BejaGNN使用图形神经网络通过分析程序行为来检测Java恶意软件. 这种新的方法实现了高精度,超过了强大的多平台安全的现有方法.
科学领域:
- 计算机科学 计算机科学
- 网络安全 网络安全
- 机器学习 机器学习
背景情况:
- 由于Java的广泛企业使用,Java恶意软件构成了重要的跨平台威胁.
- 对于Java恶意软件检测的动态分析方法,代码覆盖范围有限,效率差.
- 静态分析提供了一个有前途的替代方案,通过提取丰富的功能来有效检测恶意软件.
研究的目的:
- 开发一种新的基于行为的Java恶意软件检测方法,使用图形学习.
- 通过静态分析和神经网络,提高Java恶意软件检测的准确性和效率.
- 解决现有的动态分析技术在识别Java恶意软件方面的局限性.
主要方法:
- 从Java程序文件中使用静态分析提取程序间控制流程图 (ICFGs).
- 修剪了ICFG以消除杂的指令和精细的图形结构.
- 应用词嵌入技术来学习Java字节码指令的语义表示.
- 开发了一个图形神经网络 (GNN) 分类器,命名为BejaGNN,用于恶意确定.
主要成果:
- 在一个公共的Java字节码基准上,BejaGNN获得了98.8%的高F1分数.
- 与现有的Java恶意软件检测方法相比,提出的方法表现出了优越的性能.
- 在Java恶意软件检测领域验证了图形神经网络的有效性.
结论:
- BejaGNN为基于行为的Java恶意软件检测提供了一种有希望和有效的方法.
- 图形神经网络显示出在推进基于静态分析的恶意软件识别方面的巨大潜力.
- 该方法为应对日益增长的Java恶意软件威胁提供了强大的解决方案.
相关概念视频
01:10Detection of Black Holes
2.2K
Although black holes were theoretically postulated in the 1920s, they remained outside the domain of observational astronomy until the 1970s.
Their closest cousins are neutron stars, which are composed almost entirely of neutrons packed against each other, making them extremely dense. A neutron star has the same mass as the Sun but its diameter is only a few kilometers. Therefore, the escape velocity from their surface is close to the speed of light.
Not until the 1960s, when the first neutron...
Their closest cousins are neutron stars, which are composed almost entirely of neutrons packed against each other, making them extremely dense. A neutron star has the same mass as the Sun but its diameter is only a few kilometers. Therefore, the escape velocity from their surface is close to the speed of light.
Not until the 1960s, when the first neutron...
2.2K
01:30Classification of Neurotransmitters
3.1K
Neurotransmitters play a crucial role in the communication between neurons in the autonomic nervous system. Neurons in the autonomic nervous system can be cholinergic or adrenergic depending on the neurotransmitters synthesized. Cholinergic neurons use acetylcholine as their primary neurotransmitter. This includes all the preganglionic fibers of the sympathetic and pre- and postganglionic fibers of the parasympathetic nervous systems. In addition, neurons of the somatic nervous system also use...
3.1K
01:22Block Diagram Reduction
248
The process of deriving the transfer function of a control system often involves reducing its block diagram to a single block. This simplification can be achieved through a series of strategic operations, including relocating branch points and comparators. These operations preserve the overall function of the system while allowing for easier manipulation and combination of blocks.
The first step in this process is the identification and relocation of a branch point. A branch point, where a...
The first step in this process is the identification and relocation of a branch point. A branch point, where a...
248
01:13Mass Analyzers: Overview
741
The mass analyzer is a crucial component of the mass spectrometer. In the ionization chamber, the vaporized sample is bombarded with a high-energy electron beam to generate a radical cation and further fragment into neutral molecules, radicals, and cations. A series of negatively charged accelerator plates accelerate the cations into the mass analyzer. The mass analyzer separates ions according to their mass-to-charge (m/z) ratios and then directs them to the detector. The common types of mass...
741
01:12Types of Errors: Detection and Minimization
1.7K
Error is the deviation of the obtained result from the true, expected value or the estimated central value. Errors are expressed in absolute or relative terms.
Absolute error in a measurement is the numerical difference from the true or central value. Relative error is the ratio between absolute error and the true or central value, expressed as a percentage.
Errors can be classified by source, magnitude, and sign. There are three types of errors: systematic, random, and gross.
Systematic or...
Absolute error in a measurement is the numerical difference from the true or central value. Relative error is the ratio between absolute error and the true or central value, expressed as a percentage.
Errors can be classified by source, magnitude, and sign. There are three types of errors: systematic, random, and gross.
Systematic or...
1.7K
01:13Seizures: Classification
439
Epilepsy is primarily characterized by unpredictable seizures, either provoked by an identifiable factor, such as injury or illness, or unprovoked, occurring spontaneously without apparent cause.
Seizures are typically classified into two main categories: focal and generalized seizures.
Focal Seizures
Focal seizures originate from specific regions of the brain. These seizures are further sub-classified into two types:
Seizures are typically classified into two main categories: focal and generalized seizures.
Focal Seizures
Focal seizures originate from specific regions of the brain. These seizures are further sub-classified into two types:
439