# Malicious Powershell Detection Using Graph Convolution Network
## 1 Introduction  
The internet's rapid growth makes it a source of useful information for many people; however, the number of malicious files circulated is also increasing. According to AV-TEST [1], hundreds of thousands of new malicious files are created every day and approximately one billion malicious files are currently available. Malicious files include document-based files, powershell scripts, and Windows PE files. Powershell scripts are not downloaded to a user's computer hard disk; they are directly downloaded to their computer memory and executed. Therefore, it is challenging for existing file-based anti-virus solutions to detect powershell scripts [2; 3]. However, recent progress in AI techniques enable their use to recognize images and process natural languages [4; 5]. In addition, AI has been used in research to detect malicious files [6; 7], including malicious powershell [2; 3]. For example, convolution neural network (CNN) techniques are used for image recognition [4] and recurrent neural network (RNN) techniques are used for natural language processing [5]. Recently, a graph convolution network (GCN) was proposed [8]. Figure 1 shows that in the GCN, there are nodes and links. Each node possesses feature data and adjacent nodes that are connected to it through the links. Each node also possess features such as those of the adjacent nodes. By using GCN, each node obtains additional features from the adjacent nodes. In social network services, GCNs are used for friend or item recommendations [9]. Figure 1 shows an example of a GCN recommendation system [10]. Each node represents a user and includes a feature list of their expressed interests as well as a label indicating their gender. Moreover, each user is connected to other users. For example, a node representing a user [PERSON] indicates that she is labeled as a woman interested in clothes and cosmetics and connected to [PERSON], [PERSON], [PERSON], and [PERSON]. Similarly, [PERSON] is labeled as a man whose recorded interests include cars and baseball and he is connected to [PERSON], [PERSON], [PERSON], and [PERSON]. Since [PERSON] is interested in clothes, cosmetics, and cooking and she is a friend of [PERSON], cooking may be recommended to [PERSON] as a potential interest. Since [PERSON] is interested in cars and games and he is [PERSON]'s friend, games can be recommended to [PERSON] as well. In addition, because [PERSON] is identified in the system as a woman and [PERSON] is her friend with a feature list is similar to [PERSON]'s, the graph may indicate that [PERSON] may be identified as a woman with a high probability. Similarly, because [PERSON] is labeled as a man and [PERSON]'s feature list is similar to [PERSON]'s list, the graph shows a high probability that [PERSON] may be identified as a man. As shown in this example of a recommendation system, GCNs consider the feature lists of other nodes to determine the labels of any given node. This advantage can be adapted to an AI-based malware detection system. Existing malware detection systems generally determine whether a file is malicious by considering only its own feature list [2; 3]. However, by using GCNs in malware detection, we can use the features of other files as well as a file's own features to determine whether it is malicious. Here, we propose a new method for detecting malicious powershells using GCN. We increase the malicious powershell detection rate by using GCN when the new powershell is similar to an existing powershell scripts. First, we extract the feature data from the powershell scripts. Second, we compute the Jaccard similarities between the new powershell and existing powershell scripts. Third, we generate an adjacency matrix using Jaccard similarities [11]. Finally, we determine whether the new powershell is malicious using the GCN. In the experiments, we show that the malicious powershell detection rate is increased. The remainder of this paper is organized as follows. In Section 2, we introduce the related work.