Attention-Enhanced Graph Convolution Network for Malware Family Feature Extraction and Embedding

Understanding malware from its dynamic API call sequence is non-trivial, since the length of a call sequence might be long and the important calls might be neglected by human beings. In addition, malware call sequences are unstructured, text-based, and variable-length with semantics, making it more challenging to perform downstream analysis tasks. Unlike natural language, a call sequence may contain programming-related properties and structures, such as loops and repeated calls; therefore, this paper considers the sequence structure for analysis. In this paper, we design an Attention-Enhanced Graph Convolution Network (AEGCN) with a Markov model to learn the structure of malware call sequences for representation learning and to pinpoint the important calls in the sequence. The design of AEGCN preserves the structure of call sequences using a Markov model and adopts a customized attention structure on GCN for analysis. The proposed attention mechanism can affect the information propagation in the graph for feature extraction purposes. In real-world malware experiments, AEGCN’s sequence embeddings outperform text embedding methods and conventional GNN models in malware family classification tasks. We perform ablation experiments to examine the effectiveness of the new attention mechanisms. We also visualize the attention weight of each call to manifest its importance for the malware family classification task. That is, we can extract the features of a malware family from its unstructured call sequences to better understand the family behavior.