Mitigating the Impact of Malware Evolution on API Sequence-based Windows Malware Detector

TL;DR

This paper introduces MME, a framework that enhances API sequence-based Windows malware detection by using knowledge graphs and contrastive learning to counteract malware evolution, significantly improving detection accuracy and reducing maintenance costs.

Contribution

The paper proposes a novel framework MME that mitigates malware evolution effects on detection models using knowledge graphs and contrastive learning, improving robustness and efficiency.

Findings

Reduces false positive rate by 13.10%

Improves F1-Score by 8.47%

Saves human costs for model maintenance

Abstract

In dynamic Windows malware detection, deep learning models are extensively deployed to analyze API sequences. Methods based on API sequences play a crucial role in malware prevention. However, due to the continuous updates of APIs and the changes in API sequence calls leading to the constant evolution of malware variants, the detection capability of API sequence-based malware detection models significantly diminishes over time. We observe that the API sequences of malware samples before and after evolution usually have similar malicious semantics. Specifically, compared to the original samples, evolved malware samples often use the API sequences of the pre-evolution samples to achieve similar malicious behaviors. For instance, they access similar sensitive system resources and extend new malicious functions based on the original functionalities. In this paper, we propose a framework MME(Mitigating the impact of Malware Evolution), a framework that can enhance existing API sequence-based malware detectors and mitigate the adverse effects of malware evolution. To help detection models capture the similar semantics of these post-evolution API sequences, our framework represents API sequences using API knowledge graphs and system resource encodings and applies contrastive learning to enhance the model's encoder. Results indicate that, compared to regular Text-CNN, our framework can significantly reduce the false positive rate by 13.10% and improve the F1-Score by 8.47% on five years of data, achieving the best experimental results. Additionally, evaluations show that our framework can save on the human costs required for model maintenance. We only need 1% of the budget per month to reduce the false positive rate by 11.16% and improve the F1-Score by 6.44%.