Semantic embeddings for program behavior patterns

TL;DR

This paper introduces a novel feature extraction method using semantic embeddings of program behavior patterns, improving malicious software detection by capturing interpretable structures in execution logs.

Contribution

It presents a new technique combining pattern extraction from behavior graphs with autoencoder-based embeddings, enhancing malware detection capabilities.

Findings

Embedding space captures interpretable structures

Improved detection accuracy on real-world malware data

Effective extraction of complex behavior patterns

Abstract

In this paper, we propose a new feature extraction technique for program execution logs. First, we automatically extract complex patterns from a program's behavior graph. Then, we embed these patterns into a continuous space by training an autoencoder. We evaluate the proposed features on a real-world malicious software detection task. We also find that the embedding space captures interpretable structures in the space of pattern parts.