# Malicious Powershell Detection Using Graph Convolution Network
## 3 Malicious Powershell Detection Method Using Graph Convolution Network (GCN)
### Malicious Powershell Detection Method Using Adjacency Matrix from Jaccard Similarity  
Figure 3 shows malicious powershell detection using a GCN. We attempted to generate an adjacency matrix using the Jaccard similarity between the powershell scripts. By using GCN, we could use adjacent node features as well as its own features to determine whether it was malicious. We expected an increase in the detection rate of malicious powershells. The powershell had 20 types of tokens described as follows [3]. [Attribute, Command, CommandArgument, CommandParameter, Comment, GroupEnd, GroupStart, Keyword, LineContinuation, LoopLabel, Member, NewLine, Number, Operator, Position, StatementSeparator, String, Type, Unknown, Variable  
Figure 3: Malicious powershell detection using GCN. We used 6 types of tokens for the feature data, which is described as follows. \[\{\text{Command, CommandArgument, CommandParameters}\]  
Keyword, Member, Variable\[\}\]  
Note that in a previous study [3], we conducted many experiments using various combinations of token types and found that the best performance was exhibited when we used 6 token types. In step 1, we generated feature lists by extracting the feature data from the powershell scripts. We extracted approximately 20,000 unique tokens from the powershell scripts. In each powershell script, if the \(j\)-th token of the \(i\)-th powershell script existed, we set \(t_{ij}\) to 1. Otherwise, it was set to 0. Note that \(d\) was 20,000. The following is described. \[i-\text{th}\;\text{Powershell's Feature List}\;F_{i}=\{t_{i1},\;t_{i2},\;\cdots,\;t_{id}\}\]  
Note that we considered 1000 powershell scripts, including 3780 unique tokens in 6 token types. We used all unique tokens. However, we set \(d\) to 20,000 for scalability in future work. We had \(n\) powershell scripts and each feature list was generated from each powershell using PSParser [18]. Then, we generated an \(n\times d\) feature matrix \(X\) from \(n\) feature lists described as follows. \[X=\left[ \begin{array}{ccc}t_{11}&\cdots&t_{1d}\\ \vdots&\ddots&\vdots\\ t_{n1}&\cdots&t_{ind}\end{array} \right]\]  
If the \(i\)-th powshell script had the \(j\)-th token, then we set \(t_{ij}\) to 1; if the \(i\)-th powershell script did not have the \(j\)-th token, then we set \(t_{ij}\) to 0. In step 2, we computed the Jaccard similarities [11] between the two powershell scripts. The Jaccard similarity between \(F_{i}\) and \(F_{j}\) was computed as the following. \[\text{Jaccard Similarity}\;Sim_{i,j}=\frac{Len\big{(}S_{i}\cap S_{j}\big{)}}{Len \big{(}S_{i}\cup S_{j}\big{)}}\]  
\(S_{i}\) was a set of powershell tokens of a file \(F_{i}\) and \(S_{j}\) was a set of powershell tokens of file \(F_{j}\). Note that the Jaccard similarity index was required here to determine whether \(F_{i}\) and \(F_{j}\) are similar. In contrast, we could have used a longest common subsequence (LCS) method instead of a Jaccard similarity. However, we found that doing so required substantial computational processing time. Hence, we used Jaccard similarity. In step 3, we generated an \(n\times n\) adjacency matrix \(A\) by setting \(a_{ij}\) to 1 when the Jaccard similarity \(S_{i,j}\) was greater than the top-k similarity, described in the following. \[A=\left[ \begin{array}{ccc}a_{11}&\cdots&a_{1n}\\ \vdots&\ddots&\vdots\\ a_{n1}&\cdots&a_{nn}\end{array} \right]\]  
This meant that when \(a_{ij}\) was equal to 1, the powershell script \(F_{i}\) was similar to the powershell script \(F_{j}\). When \(a_{ij}\) was equal to 0, the powershell script \(F_{i}\) was not similar to the powershell script \(F_{j}\). In step 4, we trained the GCN using feature matrix \(X\) and adjacency matrix \(A\). Figure 4 illustrates the GCN model. It had two dropout layers and two GCN layers. In the two dropout layers, we set the dropout rate to 0.5. The first GCN layer used 16 kernels and used Rectified Linear Unit (RELU) for activation. The second layer used two kernels and SoftMax for the activation. The GCN model was defined as follows.