# Malicious Powershell Detection Using Graph Convolution Network
## 3 Malicious Powershell Detection Method Using Graph Convolution Network (GCN)
### Graph Convolution Network (GCN)  
GCN was proposed in [8]. GCN had a \(n\times d\) feature matrix \(X\), a \(n\times n\) adjacency matrix \(A\), and a \(d\times m\) weight matrix. The GCN was defined as follows the following.  
\[H=\sigma(AXW)\]  
Feature matrix \(X\) and adjacency matrix \(A\) were the input data of the GCN and \(H\) was the output of the GCN. \(\sigma\) was the activation function. By training the GCN, we updated \(W\).  
Figure 2 shows that when a graph was given, the feature matrix \(X\) was the following.  
\[X=\left[\begin{array}{ccc}x_{11}&x_{12}&x_{13}\\ x_{21}&x_{22}&x_{23}\\ x_{31}&x_{32}&x_{33}\\ x_{41}&x_{42}&x_{43}\\ x_{51}&x_{52}&x_{53}\\ x_{61}&x_{62}&x_{63}\\ x_{71}&x_{72}&x_{73}\\ x_{81}&x_{82}&x_{83}\end{array}\right]\]  
In this case, N was the number of nodes and equal to 8, d was the number of features of each node and equal to three. If \(x_{ij}\) was equal to 1, it meant that the \(i\)-th node had the \(j\)-th feature and if \(x_{ij}\) was equal to 0, it meant that it did not have the feature.  
The adjacency matrix \(A\) was as follows.  
\[A=\left[\begin{array}{cccccccc}a_{11}&a_{12}&a_{13}&a_{14}&a_{15}&a_{16}&a_{17} &a_{18}\\ a_{21}&a_{22}&a_{23}&a_{24}&a_{25}&a_{26}&a_{27}&a_{28}\\ a_{31}&a_{32}&a_{33}&a_{34}&a_{35}&a_{36}&a_{37}&a_{38}\\ a_{41}&a_{42}&a_{43}&a_{44}&a_{45}&a_{46}&a_{47}&a_{48}\\ a_{51}&a_{52}&a_{53}&a_{54}&a_{55}&a_{56}&a_{57}&a_{58}\\ a_{61}&a_{62}&a_{63}&a_{64}&a_{65}&a_{66}&a_{67}&a_{68}\\ a_{71}&a_{72}&a_{73}&a_{74}&a_{75}&a_{76}&a_{77}&a_{78}\\ a_{81}&a_{82}&a_{83}&a_{84}&a_{85}&a_{86}&a_{87}&a_{88}\end{array}\right]= \left[\begin{array}{cccccccc}0&0&0&0&0&1&0&0\\ 0&0&0&0&0&1&0&0\\ 0&0&0&0&0&0&1&0\\ 0&0&0&0&0&0&1&0\\ 0&0&0&0&0&1&0&0\\ 1&1&0&1&0&1&0\\ 0&0&1&1&0&1&0&1\\ 0&0&0&0&0&0&1&0\end{array}\right]\]  
If \(a_{i,j}\) is equal to 1, the \(i\)-th node was adjacent to the \(j\)-th node. If \(a_{i,j}\) was equal to zero, the \(i\)-th node was not adjacent to the \(j\)-th node.  
The \(d\times m\) weight matrix was as follows:  
\[W=\left[\begin{array}{cc}w_{11}&w_{12}\\ w_{21}&w_{22}\\ w_{31}&w_{32}\end{array}\right]\]  
where \(m\) was the number of output classes. Let \(S\) be XW and \(S\) is described in the following.  
\[S=\left[\begin{array}{cccc}x_{11}&x_{12}&x_{13}\\ x_{21}&x_{22}&x_{23}\\ x_{31}&x_{32}&x_{33}\\ x_{41}&x_{42}&x_{43}\\ x_{51}&x_{52}&x_{53}\\ x_{61}&x_{62}&x_{63}\\ x_{71}&x_{72}&x_{73}\\ x_{81}&x_{82}&x_{83}\end{array}\right]\left[\begin{array}{cccc}w_{11}&w_{12 }\\ w_{21}&w_{22}\\ w_{31}&w_{32}\end{array}\right]=\left[\begin{array}{cccc}S_{11}&S_{12}\\ S_{21}&S_{22}\\ S_{31}&S_{32}\\ S_{41}&S_{42}\\ S_{51}&S_{52}\\ S_{51}&S_{52}\\ S_{61}&S_{62}\\ S_{71}&S_{72}\\ S_{81}&S_{82}\end{array}\right]\]  
Then, we computed the following.  
\[H=\sigma(AS)=\sigma(\left[\begin{array}{cccccccc}0&0&0&0&0&1&0&0\\ 0&0&0&0&0&1&0&0 Here, \(h_{71}\) and \(h_{72}\) were computed as follows.  
\[h_{71}=\sigma(s_{31}+s_{41}+s_{61}+s_{81})h_{72}=\sigma(s_{32}+s_{42}+s_{62}+s_{8 2})\]  
This meant that the output of node \(n_{7}\) depended on the adjacent nodes, such as \(n_{3}\), \(n_{4}\), \(n_{6}\), and \(n_{8}\).  
The \(n\times m\) output was as follows.  
\[H=\left[\begin{array}{cc}h_{11}&h_{12}\\ h_{21}&h_{22}\\ h_{31}&h_{32}\\ h_{41}&h_{42}\\ h_{51}&h_{52}\\ h_{61}&h_{62}\\ h_{71}&h_{72}\\ h_{81}&h_{82}\end{array}\right]\]  
Note that in the malicious powershell detection problem, the output was normal or malicious. Using the GCN, we determined each node's class. For example, in a karate club network [16], they determined an unlabeled club member's class using the GCN.  
However, the adjacency matrix did not contain any node itself. We added an identity matrix \(I\) to it as follows.  
\[\widetilde{A}=A+I\]  
Then, we normalized it as follows.  
\[H=\sigma\Big{(}\widetilde{D}^{-1/2}\widetilde{A}\widetilde{D}^{1/2}XW\Big{)}\]  
Note that \(\widetilde{D}\) was a degree matrix [17] of \(\widetilde{A}\).