一句话：提出基于图的 API 序列嵌入方法 API2Vec，通过建模进程间与进程内行为提升多进程恶意软件检测。
针对基于 API 调用序列的恶意软件检测中，原始序列难以处理多进程 API 交错、难以捕捉细粒度行为的问题，本文提出 API2Vec。该方法首先构建时序进程图（TPG）建模进程间行为，以及时序 API 图（TAG）建模进程内行为；随后设计启发式随机游走生成可反映恶意行为的路径，并用 Doc2Vec 预训练得到路径和 API 的嵌入；最后将嵌入用于恶意软件检测。在真实恶意软件数据集上的实验表明，API2Vec 在准确率和鲁棒性上优于现有嵌入方法和检测方法，对多进程恶意软件尤其有效。
Analyzing malware based on API call sequence is an effective approach as the sequence reflects the dynamic execution behavior of malware.Recent advancements in deep learning have led to the application of these techniques for mining useful information from API call sequences. However, these methods mainly operate on raw sequences and may not effectively capture important information especially for multi-process malware, mainly due to the API call interleaving problem. Motivated by that, this paper presents API2Vec, a graph based API embedding method for malware detection. First, we build a graph model to represent the raw sequence. In particular, we design the temporal process graph (TPG) to model inter-process behavior and temporal API graph (TAG) to model intra-process behavior. With such graphs, we design a heuristic random walk algorithm to generate a number of paths that can capture the fine-grained malware behavior. By pre-training the paths using the Doc2Vec model, we are able to generate the embeddings of paths and APIs, which can further be used for malware detection. The experiments on a real malware dataset demonstrate that API2Vec outperforms the state-of-the-art embedding methods and detection methods for both accuracy and robustness, especially for multi-process malware.
@inproceedings{0003CJHLD23,
title = {API2Vec: Learning Representations of API Sequences for Malware Detection},
author = {Lei Cui and Jiancong Cui and Yuede Ji and Zhiyu Hao and Lun Li and Zhenquan Ding},
booktitle = {ISSTA},
year = {2023},
doi = {10.1145/3597926.3598054}
}