通过图简化与可解释性技术，提升恶意软件检测的效率与透明度。
Explainable Malware Detection through Integrated Graph Reduction and Learning Techniques
- 提出图压缩技术，大幅减小控制流图与函数调用图规模。
- 结合GNNExplainer实现高精度检测，准确率保持在98.2%以上。
- 适合需要透明决策过程的安全分析人员使用。
控制流图和函数调用图已成为深入理解程序执行行为、有效表征恶意软件特征的关键手段。将这些基于图的表示与图神经网络（GNN）结合，已展现出高性能恶意软件检测的潜力。然而，由于图结构庞大且GNN决策过程缺乏可解释性，仍面临挑战。本文提出多种图简化技术以降低图规模，并应用最先进的GNNExplainer提升GNN输出的可解释性。实验表明，在恶意软件检测框架中集成所提出的图简化技术与GNNExplainer，显著减小了图规模，同时保持高检测性能，实现了效率与透明度的有效平衡。
原文摘要 · Abstract (English)
Control Flow Graphs and Function Call Graphs have become pivotal in providing a detailed understanding of program execution and effectively characterizing the behavior of malware. These graph-based representations, when combined with Graph Neural Networks (GNN), have shown promise in developing high-performance malware detectors. However, challenges remain due to the large size of these graphs and the inherent opacity in the decision-making process of GNNs. This paper addresses these issues by developing several graph reduction techniques to reduce graph size and applying the state-of-the-art GNNExplainer to enhance the interpretability of GNN outputs. The analysis demonstrates that integrating our proposed graph reduction technique along with GNNExplainer in the malware detection framework significantly reduces graph size while preserving high performance, providing an effective balance between efficiency and transparency in malware detection.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。