Classifying Packed Malware Represented as Control Flow Graphs using Deep Graph Convolutional Neural Network

Abstract

In recent years, the variety and quantity of malware has increased rapidly, which makes classification based on fixed features very difficult. In order to better preserve the integrity of the malware, we extract the control flow graph of malware as the feature information. However, control flow graph of a packed malware consists of both unpack control flow graph and local control flow graph. In order to obtain a clean control flow graph, we analysis the packed malware dynamically and apply an algorithm to strip the unpacking routine from the graph. With the rapid development of Graph Neural Network (GNN), we use Deep graph Convolutional Network (DGCNN) to classify control flow graph data. Experimental results show that the proposed method can achieve 96.4% accuracy.