FewM-HGCL : Few-Shot Malware Variants Detection Via Heterogeneous Graph Contrastive Learning
Chen Liu, Bo Hu Li, Jun Zhao, Ziyang Zhen, Xudong Liu, Qunshi Zhang · IEEE Transactions on Dependable and Secure Computing · 2022
Malware variant attacks have been becoming serious threats in the Internet ecosystem. However, prior arts on malware variants detection over-rely on the supervised learning methods to identify the malware variants using a large number of labeled samples, resulting in their inability to detect the few-shot malware without sufficient samples and ground-truth labels. In this paper, we propose FewM-HGCL, a self-supervisedFew-shotMalware variants detection framework based onHeterogeneousGraphContrastiveLearning, which models the execution behavior of each malware variant as a heterogeneous graph and performs graph instance-based discrimination. Particularly, FewM-HGCL first models the execution behavior of each malware variant with a fine-grained attribute heterogeneous graph, which effectively depicts the interactive relationships between malware objects (e.g., API, process, etc). Then three types of heterogeneous graph data augmentations are proposed,i.e., API attribute masking, interaction enhancing, and meth-path sampling, to generate more robust positive and negative samples for each instance, incorporating semantic prior or structural prior, respectively. Afterward, FewM-HGCL utilizes heterogeneous graph contrastive learning to empower graph attention networks (GATs) to learn the graph-level representations for few-shot malware variants in a self-supervised manner. Experimental results show that the proposed FewM-HGCL on diverse datasets can achieve 70.47%$\sim$98.65% accuracy, which are 0.45%$\sim$8.46% improvements over previous state-of-the-art methods on the few-shot malware variants detection tasks.