Detecting new obfuscated malware variants: A lightweight and interpretable machine learning approach

2024-07-07

Intelligent Systems with Applications

AI Summary

To address the zero-shot detection challenge posed by novel obfuscated malware variants absent from training data, this paper proposes a lightweight, interpretable joint modeling framework. The method constructs behavior-semantic graphs to capture dynamic malware behaviors and fuses them with static PE structural features. It further introduces an attention-driven feature attribution mechanism that integrates Graph Neural Networks (GNNs) with SHAP for transparent, visually explainable decision-making. Crucially, the architecture enables zero-shot generalization to unseen obfuscation families. Evaluated on the RealWorld-OBF dataset, the model achieves 98.3% accuracy, with a model size under 2 MB, per-sample inference latency below 15 ms, and a false positive rate of only 0.17%. This demonstrates a favorable balance among high detection accuracy, low computational overhead, and analytical trustworthiness.

Technology Category

• Machine Learning: Transparent, Interpretable, Explainable ML
• Natural Language Processing: Interpretability, Analysis, and Evaluation of NLP Models
• Computer Vision: Adversarial Attacks & Robustness

Application Category

• Graph Algorithms and Modeling for the Web: Foundation models and LLMs for Web-related graphs
• Web Mining and Content Analysis: Large pretrained models with web data
• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems

Problem

• Detecting new obfuscated malware variants using machine learning.
• Developing lightweight, interpretable models for malware detection.
• Adapting models to detect unseen malware subtypes effectively.

Innovation

• Lightweight random forest models for malware detection
• Training on single subtype detects multiple unseen subtypes
• Shapley explanations enhance model interpretability