---
title: "MG-DVD: A Real-time Framework for Malware Variant Detection Based on Dynamic Heterogeneous Graph Learning"
authors:
  - "Chen Liu"
  - "Bo Li"
  - "Jun Zhao"
  - "Ming Su"
  - "Xu-Dong Liu"
doi: "10.24963/ijcai.2021/209"
url: "https://ijcai.org/proceedings/2021/209"
pdf: "https://ijcai.org/proceedings/2021/0209.pdf"
venue: "Proceedings of the Thirtieth International Joint Conference on Artificial Intelligence"
year: 2021
pages: "1512-1519"
track: "Main Track"
keywords:
  - "Data Mining: Anomaly/Outlier Detection"
  - "Machine Learning: Deep Learning"
  - "Multidisciplinary Topics and Applications: Real-Time Systems"
---

# MG-DVD: A Real-time Framework for Malware Variant Detection Based on Dynamic Heterogeneous Graph Learning

Chen Liu, Bo Li, Jun Zhao, Ming Su, Xu-Dong Liu

*Proceedings of the Thirtieth International Joint Conference on Artificial Intelligence*, pages 1512-1519. DOI: [10.24963/ijcai.2021/209](https://doi.org/10.24963/ijcai.2021/209)

## Abstract

Detecting the newly emerging malware variants in real time is crucial for mitigating cyber risks and proactively blocking intrusions.  In this paper, we propose  MG-DVD,  a novel detection framework based on dynamic heterogeneous graph learning, to detect malware variants in real time.  Particularly, MG-DVD first models the fine-grained execution event streams of malware variants into dynamic heterogeneous graphs and investigates real-world meta-graphs between malware objects,  which can effectively characterize more discriminative malicious evolutionary patterns between malware and their variants. Then,  MG-DVD presents two dynamic walk-based heterogeneous graph learning methods to learn more comprehensive representations of malware variants,  which significantly reduces the cost of the entire graph retraining. As a result, MG-DVD  is equipped with the ability to detect malware variants in real time, and it presents better interpretability by introducing meaningful meta-graphs. Comprehensive experiments on large-scale samples prove that our proposed  MG-DVD  outperforms state-of-the-art methods in detecting malware variants in terms of effectiveness and efficiency.