BAR 2023

FCGAT: Interpretable Malware Classification Method
using Function Call Graph and Attention Mechanism
March 3, 2023

Minami Someya*† Yuhei Otsubo†* Akira Otsuka** Institute of Information Security, Japan† National Police Agency, Japan

Malware Classification• Identifies malware family or category
Emotet,Trickbot …

Downloader,
Ronsomware …

• Usefulness of malware classification:• Understands malware behavior• Helps with malware analysis• Limitations of conventional signature-based methods:• Cannot keep up with creating pattern files of new malware• Solution:• Use machine learning to classify malware
2

Drawbacks in ML Method: Lack of Interpretability• ML-models are often treated as black boxes

ML modelWhy Trickbot?
Where’s the malicious code?
IcedIDTrickbot• Model interpretability and performanceare often in a trade-off relationship

Model performance

njrat

Deep learning

High

Decision Trees
Low
Low

Model interpretability

High3OverviewResearch Goals• Creating classifier that can explain the reasons for malware classification• Achieving both high classification performance and interpretability
Solution• FCGAT: Interpretable Malware Classification Method
using Function Call Graph and ATtention Mechanism
Contributions• Successfully classified malware families with high performance comparable tocutting-edge methods• Analyzed the explanations and obtained insight into the functions thatcharacterize malware
4Determining Feature Set
Byte

Basic Block

Function
funcA

5A

mov ebx, [ebp+8]
jmp short loc_100013

push ebp
mov ebp, esp…
call OpenMutexA

Which feature set should we use?
We need to consider the interpretability of explanation results.

5Determining Feature Set
Byte

Basic Block

Function
funcA

mov ebx, [ebp+8]
jmp short loc_100013

5A

Control Flow Graph (CFG)
3B 52 2B F3 25 68 AD
33 55 6A 11 9A 4C B42B CA 4B D3 75 98 AD
45 7A 24 F3 27 68 4D
3B 5A 2C FB 25 69 CD
25 6A 23 F3 5A 2B F334 52 2B F3 25 58 A4

push ebp
mov ebp, esp…
call OpenMutexA

Function Call Graph (FCG)
start

mov ebx, [ebp+8]
jmp short loc_100013

funcA

cmp byte ptr [ebx], 0jnz short loc_100021

funcB
pop edipop esi…

explanation results(important feature)

Difficult to interpret
The granularity is too smallOpenMutexAInternetOpenW

Easy to interpret
6

Why Function-based Feature• Easier to interpret than byte or basic block• Often reused in a same malware family• Malware is rarely implemented from scratch• Functions and their relationships are focused on during analysis→ Function Call Graph (FCG)

7

Graph Neural Network (GNN)• Updating feature to reflect the graph structure

1. AGGREGATE:
Aggregate features of neighboring nodes

COMBINE

updateAGGREGATE

2. COMBINE:
Update the features of the node to be
updated using the neighboring nodes
3. READOUT:
Obtain a representation of the entire graphfrom the nodes in the graph

ℎ2𝑘−1
ℎ3𝑘−1

ℎ1𝑘−1 ℎ4𝑘−1ℎ2𝑘ℎ3𝑘ℎ1𝑘READOUTℎ4𝑘ℎ𝐺8

Related Work: CFGExplainer• Explanation method for GNN-based malware classification models• Uses Control Flow Graph with Basic Blocks as nodes• Identifies subgraph that contributes most to classificationby pruning less important nodes• Difference from our research:• CFGExplainer uses basic block, our FCGAT uses function

Herath et al. 2022. “CFGExplainer: Explaining Graph Neural Network-Based Malware Classification from Control Flow Graphs.” In2022 52nd Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN). IEEE.
9Overview of FCGAT• Preprocessing• Creating Function Call Graph• Creating feature vector of function (function vector)• Classifier• Malware classification using Graph Neural Network

10

Preprocessing• Creating Function Call Graph• Using IDA Pro• Reversing arrows of FCG• The processing of called function
is included in that of calling function

General FCG

Reverse FCG

start

start

sub_00436160

sub_004360b0

sub_00436160

sub_004360b0

sub_004365d0

InternetOpenW

sub_004365d0

InternetOpenW

11

Preprocessing• Creating Function Call Graph• Using IDA Pro• Reversing arrow of FCG• Creating function vectors• Using Word2vec for creating instruction vectors• Instruction ↔ word, function ↔ sentence• Averaging instruction vectors in a function to obtain a function vector

12Classifier• Graph Attention Network（GAT）• Updating function vectors using FCG• Set2Set (readout process)• Next slide• Fully Connected (final layer)• Classifying into a number of classes
13

Set2Set (readout process)• The key to interpretability• Inputs :Outputs:

Updated function feature
Feature of the malware• A larger(attention weight) is assigned tothe more important function vector• Importance ranking of function is provided

14

Experiments• Classification Performance• Perform malware family classification• Compare with demonstration results of existing studies by Ma et al.
• Conduct a replicated experiment of GEMAL (using FCG but not interpretable)• Classification Interpretability• Perform malware category classification• Extract the importance ranking of functions as explanations• Confirm the effectiveness of these explanations

Ma, Yixuan et al. 2021. “A Comprehensive Study on Learning-Based PE Malware Family Classification Methods.” In Proceedings ofthe 29th ACM Joint Meeting on European Software Engineering Conference and Symposium on the Foundations of Software
Engineering, 1314–25. ESEC/FSE 2021.
Wu, Xiao-Wang et al. 2022. “Embedding Vector Generation Based on Function Call Graph for Effective Malware Detection andClassification.” Neural Computing & Applications.
15Classification Performance
Category

Image

BinaryDisassembly

Model

MalwareBazaar dataset

BIG-2015

Accuracy

Precision

Recall

F1-Score

Accuracy

Precision

Recall

F1-Score

ResNet-50

96.68

96.91

96.75

96.83

98.42

96.57

95.68

96.08

VGG-16

96.35

96.58

96.54

96.56

93.94

90.32

81.89

87.27

Inception-V3

95.83

95.67

95.79

95.73

96.99

93.67

94.46

94.03

IMCFN

97.38

97.53

97.41

97.47

97.77

95.93

94.81

95.13

CBOW+MLP

97.81

97.92

98.08

98.00

98.41

97.63

96.67

97.12

MalConv

95.92

96.04

96.43

96.20

97.02

94.34

92.62

93.33

MAGIC

92.82

88.03

87.36

87.45

98.05

96.75

94.03

95.14

Word2vec+KNN

95.64

93.34

94.29

93.79

98.07

96.41

96.51

96.45

MCSC

96.80

94.97

94.51

94.70

97.94

95.97

96.17

96.06

FCGAT

98.11

98.03

98.27

98.15

99.27

97.93

98.45

98.18

GEMAL

97.71

97.65

98.00

97.82

99.37

98.26

98.48

98.37

FCGAT outperforms all other methodson all metrics

by Ma et al.

by us

FCGAT is equivalent to
the replication experiment of GEMAL

16

Classification Interpretability• Malware category classification• Malicious behavior is more common in categories• Dataset: BODMAS-8cat• Exclude packed samples detected by peid from BODMAS

Yang, Limin et al. 2021. “BODMAS: An Open Dataset for Learning Based Temporal Analysis of PE Malware.” In 2021 IEEE Security andPrivacy Workshops (SPW), 78–84.

17How much do important functions contribute to classification?
• Measuring the classification performances of subgraphs
Importance ranking
func3

1%
subgraph

func6…

func1010%
subgraphfunc52
func30

func33…

…

func70Evaluateclassification performance90%
subgraph100%= original graphsubgraph18

Classification Accuracies of Subgraphs• Only top 6 functions (average per sample) achieve
69.67% accuracy• Comparison with existing study• CFGExplainer showed 52.39% accuracy in the 10%
subgraph• FCGAT achieves 71.73% accuracy !

• Using function, malware can be characterized witha small number of nodes

19

Trend Analysis of Malware Categories
Aggregate results for each category of functions with max attention weights• Some functions reflect category characteristics
20

Case Study: Ransomware/ GandCrab• GandCrab is ransomware that appeared in 2018
• We will see two samples, GandCrab#1 and GandCrab#2
DLL file

EXE file• These samples are common to the top two important functions,
aes_encrypt and aes_decrypt, which are characteristic of ransomware
21

Conclusion• Proposed FCGAT• The first study to explain malware classification on a per function basis• Evaluated classification performance• High performance competitive to the latest method• Confirmed the effectiveness of the explanations• Functions that reflect the malware feature• A small number of functions characterizing malware

Contact: mgs227501@iisec.ac.jp22