Similarity-Based Malware Classification Using Graph Neural Networks

This work proposes a novel malware identification model that is based on graph neural network (GNN). The function call relationship and assembly content obtained by analyzing the are used to generate represents functional structure of sample. In addition establishing multi-classification for predicting family, this implements similarity Siamese networks, measuring distance between two samples in feature space determine whether they belong same family. gradually adjusted during training improve performance. A Malware Bazaar dataset analysis reveals proposed classification has an accuracy area under curve (AUC) 0.934 0.997, respectively. AUC 0.92 0.92, Further, identifies unseen family with approximately 70% accuracy. Hence, exhibits better performance scalability than pure previous studies.