{"type":"ScholarlyArticle","title":"MG-DVD: A Real-time Framework for Malware Variant Detection Based on Dynamic Heterogeneous Graph Learning","authors":[{"name":"Chen Liu","slug":"chen-liu","given":"Chen","family":"Liu","affiliation":""},{"name":"Bo Li","slug":"bo-li","given":"Bo","family":"Li","affiliation":""},{"name":"Jun Zhao","slug":"jun-zhao","given":"Jun","family":"Zhao","affiliation":""},{"name":"Ming Su","slug":"ming-su","given":"Ming","family":"Su","affiliation":""},{"name":"Xu-Dong Liu","slug":"xu-dong-liu","given":"Xu-Dong","family":"Liu","affiliation":""}],"abstract":"Detecting the newly emerging malware variants in real time is crucial for mitigating cyber risks and proactively blocking intrusions.  In this paper, we propose  MG-DVD,  a novel detection framework based on dynamic heterogeneous graph learning, to detect malware variants in real time.  Particularly, MG-DVD first models the fine-grained execution event streams of malware variants into dynamic heterogeneous graphs and investigates real-world meta-graphs between malware objects,  which can effectively characterize more discriminative malicious evolutionary patterns between malware and their variants. Then,  MG-DVD presents two dynamic walk-based heterogeneous graph learning methods to learn more comprehensive representations of malware variants,  which significantly reduces the cost of the entire graph retraining. As a result, MG-DVD  is equipped with the ability to detect malware variants in real time, and it presents better interpretability by introducing meaningful meta-graphs. Comprehensive experiments on large-scale samples prove that our proposed  MG-DVD  outperforms state-of-the-art methods in detecting malware variants in terms of effectiveness and efficiency.","doi":"10.24963/ijcai.2021/209","url":"https://ijcai.org/proceedings/2021/209","pdf":"https://ijcai.org/proceedings/2021/0209.pdf","markdown":"https://ijcai.org/proceedings/2021/209.md","bibtex":"https://ijcai.org/proceedings/2021/bibtex/209","volume":{"slug":"2021","title":"Proceedings of the Thirtieth International Joint Conference on Artificial Intelligence","short_title":"IJCAI 2021","url":"https://ijcai.org/proceedings/2021/","year":2021,"location":"Montreal","dates":"19-27 August 2021","editors":"Prof. Zhi-Hua Zhou","isbn":"978-0-9992411-9-6","publisher":"International Joint Conferences on Artificial Intelligence Organization","doi_prefix":"10.24963/ijcai.2021"},"section":"Data Mining","track":"Main Track","number":209,"pages":{"first":1512,"last":1519},"keywords":["Data Mining: Anomaly/Outlier Detection","Machine Learning: Deep Learning","Multidisciplinary Topics and Applications: Real-Time Systems"],"videos":[],"references":[],"license_note":"Copyright International Joint Conferences on Artificial Intelligence."}