Enhanced Mining Malware Detection Using Graphical Structure-Aware Transformer (GAT) Networks

In recent years, the proliferation of cryptocurrency mining malware has posed significant threats to internet and computer users, leading to substantial losses. However, current research on mining malware detection tends to focus on single static features like opcodes or raw bytes, or some studies attempt to combine multiple static features, often overlooking the inherent correlations among them. To address these limitations, this paper presents a novel approach to detecting mining malware using Graphical Architecture-Aware Transformer (GAT) networks. We analyze three static features in malware samples: basic blocks, control flow graphs, and function call graphs, meticulously examining the connections between them, including jump relationships and process dependencies. Experimental results show that our detection model achieves more effective mining malware detection compared to the most recent related models.