FewM-HGCL : Few-Shot Malware Variants Detection Via Heterogeneous Graph Contrastive Learning
Chen Liu, Bo Li, Jun Zhao, Ziyang Zhen, Xudong Liu, Qunshi Zhang
Abstract
Malware variant attacks have been becoming serious threats in the Internet ecosystem. However, prior arts on malware variants detection over-rely on the supervised learning methods to identify the malware variants using a large number of labeled samples, resulting in their inability to detect the few-shot malware without sufficient samples and ground-truth labels. In this paper, we propose FewM-HGCL, a self-supervised <underline xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">Few</u> -shot <underline xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">M</u> alware variants detection framework based on <underline xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">H</u> eterogeneous <underline xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">G</u> raph <underline xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">C</u> ontrastive <underline xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">L</u> earning, which models the execution behavior of each malware variant as a heterogeneous graph and performs graph instance-based discrimination. Particularly, FewM-HGCL first models the execution behavior of each malware variant with a fine-grained attribute heterogeneous graph, which effectively depicts the interactive relationships between malware objects ( <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">e.g.</i> , API, process, etc). Then three types of heterogeneous graph data augmentations are proposed, <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">i.e.</i> , API attribute masking, interaction enhancing, and meth-path sampling, to generate more robust positive and negative samples for each instance, incorporating semantic prior or structural prior, respectively. Afterward, FewM-HGCL utilizes heterogeneous graph contrastive learning to empower graph attention networks (GATs) to learn the graph-level representations for few-shot malware variants in a self-supervised manner. Experimental results show that the proposed FewM-HGCL on diverse datasets can achieve 70.47% <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">$\sim$</tex-math></inline-formula> 98.65% accuracy, which are 0.45% <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">$\sim$</tex-math></inline-formula> 8.46% improvements over previous state-of-the-art methods on the few-shot malware variants detection tasks.