基於程式語義表示向量之靜態惡意程式偵測方法

惡意程式已經給人們帶來了資料和金錢上的損失，而且這些惡意程式的數量如今還在迅速增加。面對大量的未知攻擊程式，安全分析人員必須快速識別惡意程式並報告其中的關鍵行為。然而人工分析是緩慢且沒有效率的，我們相信在程式中識別基本功能的自動化方法是加速分析過程的關鍵。這項研究提出了一個惡意程式偵測系統，可以將惡意程式與正常程式區分開來。同時，透過函式呼叫圖搭配函式嵌入向量和圖神經網路，我們的系統可以進一步識別程式中的基本功能，並將涉及的函數呼叫關係視覺化。我們使用可以在 Windows 作業系統上執行的程式來評估我們提出的系統，該作業系統擁有最大的市佔率和最多的惡意程式。評估結果顯示，我們的系統具有與最先進的惡意程式偵測模型類似的檢測效能（準確率 97.0％，召回率 97.6％）。此外，它還透過視覺化和關聯基本函式的功能，對模型預測結果給出了直觀和易於理解的解釋。

關鍵字

程式嵌入向量；可解釋機器學習；圖神經網路；惡意程式偵測；語意表示

並列摘要

Malicious binaries have caused both data and monetary loss to people, and the number of these binaries are kept increasing rapidly nowadays. With tons of unknown attack binaries, it is fundamental for security analysts to quickly identify malicious parts and report the critical behaviors within the binaries. While manual analysis is slow and ineffective, we believe an automated approach for identifying essential functions in binaries is the key to accelerating the analysis process. This study proposes a malware detection system that differentiates malicious binaries from benign ones. In the meantime, by leveraging call graph-based function embeddings and graph neural networks, the proposed system further identifies essential functions in binaries and visualizes the relationships between involved parts. We evaluate our proposed system using executable binaries in the Windows system, which has the largest market share and most malware binaries. The evaluation results show that our system has a similar detection performance (97.0% accuracy and 97.6% recall) to state-of-the-art malware detection models. Moreover, it also gives an intuitive and easy-to-understand explanation of the model prediction results by visualizing and correlating essential functions.