A graph-based framework for malicious software detection and classification utilizing temporal-graphs

Article type: Research Article

Authors: Dounavi, Helen-Maria | Mpanti, Anna | Nikolopoulos, Stavros D.^{; *} | Polenakis, Iosif

Affiliations: Department of Computer Science & Engineering, University of Ioannina, Ioannina, Greece. E-mails: [email protected], [email protected], [email protected], [email protected]

Correspondence: [*] Corresponding author. E-mail: [email protected].

Abstract: In this paper we present a graph-based framework that, utilizing relations between groups of System-calls, detects whether an unknown software sample is malicious or benign, and classifies a malicious software to one of a set of known malware families. In our approach we propose a novel graph representation of dependency graphs by capturing their structural evolution over time constructing sequential graph instances, the so-called Temporal Graphs. The partitions of the temporal evolution of a graph defined by specific time-slots, results to different types of graphs representations based upon the information we capture across the capturing of its evolution. The proposed graph-based framework utilizes the proposed types of temporal graphs computing similarity metrics over various graph characteristics in order to conduct the malware detection and classification procedures. Finally, we evaluate the detection rates and the classification ability of our proposed graph-based framework conducting a series of experiments over a set of known malware samples pre-classified into malware families.

Keywords: Malicious software, malware classification, security, temporal graphs, graph similarity

DOI: 10.3233/JCS-210057

Journal: Journal of Computer Security, vol. 29, no. 6, pp. 651-688, 2021