Behavioral Malware Detection using Deep Graph Convolutional Neural Networks
Angelo Schranko de Oliveira, Renato Jos ́e Sassi
Abstract
Malware behavioral graphs provide a rich source of information that can be leveraged for detection and classification tasks. In this paper, we propose a new behavioral malware detection method that extracts behavioral graphs from API call sequences and uses a Deep Graph Convolutional Neural Network (DGCNN), a state-of-the-art neural network architecture that can directly accept graphs of arbitrary structures, to learn a binary classification function able to distinguish between malware and goodware. In order to train and evaluate the models, we created a new public domain dataset of more than 40,000 API call sequences resulting from the execution of malware and goodware instances in a sandboxed environment. Experimental results show that our models achieve similar Area Under the ROC Curve (AUC-ROC), F1-Score, Precision, and Recall to Long-Short Term Memory (LSTM) networks, widely used as the base architecture for sequence learning in behavioral malware detection methods, thus indicating that the models can effectively learn to classify malicious and benign temporal patterns through convolution operations on graphs. To the best of our knowledge, this is the first paper that investigates the applicability of DGCNN to behavioral malware detection using API call sequences.