A Graph Neural Network Framework for Dynamic Malware Detection Using Api Calls and Lightweight Containers
The growing sophistication of malware poses a persistent challenge to traditional detection systems. To address the limitations of conventional static and dynamic analysis methods, this paper proposes a novel malware detection framework that integrates dynamic behavior monitoring with graph-based le...
Uloženo v:
| Vydáno v: | 2025 5th International Conference on Intelligent Communications and Computing (ICICC) s. 294 - 301 |
|---|---|
| Hlavní autoři: | , , , , , , |
| Médium: | Konferenční příspěvek |
| Jazyk: | angličtina |
| Vydáno: |
IEEE
15.08.2025
|
| Témata: | |
| On-line přístup: | Získat plný text |
| Tagy: |
Přidat tag
Žádné tagy, Buďte první, kdo vytvoří štítek k tomuto záznamu!
|
| Shrnutí: | The growing sophistication of malware poses a persistent challenge to traditional detection systems. To address the limitations of conventional static and dynamic analysis methods, this paper proposes a novel malware detection framework that integrates dynamic behavior monitoring with graph-based learning. Leveraging lightweight container (LXC) technology, we construct an efficient and isolated environment for capturing fine-grained API call sequences and contextual parameters during malware execution. These behavioral traces are transformed into heterogeneous graphs, where API calls, process/thread identifiers, and program entities are modeled as nodes with semantic embeddings, while their temporal and structural dependencies are encoded as weighted edges. To extract and aggregate structural and semantic information from the constructed graphs, we design a deep graph classification architecture based on a multi-layer Graph Attention Network (GAT). The network incorporates hierarchical attention mechanisms, including multi-head intra-layer attention and crosslayer residual connections, to effectively capture both local and global behavioral patterns. Additionally, a Self-Attention Graph Pooling (SAGPooling) strategy is applied to retain the most informative substructures, while a joint readout mechanism combining global max and average pooling enhances graph-level representation. The final classification is performed through a multi-layer perceptron, optimized with Focal Loss to address label imbalance in real-world datasets. Extensive experiments on multiple benchmark datasets-including Linux and Windows malware corpora-demonstrate the superiority of the proposed method over conventional baselines in terms of accuracy, precision, recall, and \mathbf{F 1} score. This work contributes an effective and scalable solution for dynamic malware detection and highlights the promise of deep graph neural architectures in advanced cybersecurity applications. |
|---|---|
| DOI: | 10.1109/ICICC66840.2025.11199642 |