Content area
Full text
Abstract: The increasing complexity and sophistication of malware pose significant challenges to traditional detection techniques. Conventional methods like signature-based detection are ineffective against advanced threats such as polymorphic and zero-day malware. This research investigates the application of Dynamic Graph Neural Networks (DGNNs) for malware detection using a dataset of API call sequences. DGNNs, an advanced form of Graph Neural Networks, are capable of modeling dynamic graphs, capturing both the temporal and structural evolution of API interactions. Using these strengths, the study develops and evaluates a DGNN-based framework designed to effectively distinguish between benign and malicious behavior in real time, demonstrating its suitability for detecting complex, evolving malware patterns. The results show that DGNN outperform traditional machine learning models in detecting complex malware patterns, achieving high accuracy of up to 97%, Fl scores of up to 98% in unbalanced datasets, and competitive results in balanced datasets. The models also achieved ROC-AUC scores exceeding 97% in specific configurations, highlighting their effectiveness in identifying advanced malware pat- terns and resilience against novel threats. Although challenges in scalability and computational complexity remain, this work proposes potential solutions to enhance practical implementation. These findings highlight the potential of DGNNs to transform malware detection and significantly improve endpoint security, making them a promising tool for addressing the evolving challenges of modern cybersecurity.
Keywords: Malware detection, API call sequences, Dynamic graph neural networks, Machine learning, Endpoint security
1. Introduction
The rapid evolution and increasing complexity of malware have rendered traditional detection methods insufficient in addressing modern cybersecurity threats. Conventional approaches, such as signature-based and heuristic detection, fail to identify polymorphic and zero-day malware due to their static nature and reliance on pre-existing patterns. Malware authors have adopted advanced techniques, including polymorphism, metamorphism, and sophisticated obfuscation, to bypass these detection systems. This necessitates the development of more dynamic and robust solutions.
This research addresses the critical challenge of detecting malware in dynamic and evolving environments by leveraging Dynamic Graph Neural Networks (DGNNs). DGNNs extend the capabilities of traditional Graph Neural Networks (GNNs) by incorporating the dimension of graph data, enabling the modelling of complex interactions and patterns over time. This unique ability makes DGNNs well-suited for analysing API call sequences, which capture the behavioural characteristics of malware during execution.
The scientific question...