Learning Explainable Multi-view Representations for Malware Authorship Attribution

Malware poses an ever-growing threat to organizations, governments, and institutions. To effectively combat its proliferation and development by threat actors, identifying the authors of malware is a crucial step. Existing efforts in malware authorship attribution often focus on extracting stylistic features from source code. However, malware source code is frequently limited in availability. There is a strong need to develop effective methods to directly extract a robust and salient representation from malware binaries. This representation should adeptly capture the inherent characteristics of the binaries to facilitate the identification of malware authors. In our work, we introduce an approach that leverages multi-view graph representation learning for malware authorship attribution. We extract various intermediate representations from the binary, including control flow graphs and function call graphs. These representations are encoded using GNN-based functions and fused to create a comprehensive malware representation. Additionally, we introduce GNN-explainability approaches to identify subgraphs indicative of class membership. Our experiments on a recent benchmark demonstrate significant performance enhancements in authorship attribution.