Malicious VBA Detection via Graph Neural Network Call Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current antivirus engines struggle to keep up with the increasing number of new macros being used as a vector for malicious attacks, as these macros often evade detection due to their ability to execute automatically and obfuscate their code.
Innovation Solution
The use of graph neural networks to detect malicious code by creating a call graph from computer code, vectorizing functions based on APIs and tokenization, and applying trained GNNs and attention neural networks to generate a malicious score based on the probability distribution of function maliciousness.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional antivirus engines are used to scan macros, then the scanning process is simple and fast, but the detection accuracy is low and malicious macros are not identified
Solution Approach 1:
The patent segments the macro code into individual functions and represents them as nodes in a call graph. Each function is analyzed separately and assigned a maliciousness score, allowing the system to detect malicious patterns at the function level rather than requiring full-code analysis, thus improving detection accuracy while managing complexity
Solution Approach 2:
The patent introduces a graph neural network as an intermediary between the macro code and the detection system. The GNN processes the call graph structure and function characteristics to generate maliciousness scores, acting as a mediator that translates complex code patterns into detectable features without requiring the antivirus engine to directly analyze raw macro code
2Extent of automation
If macros are allowed to execute automatically, then automation capability is high, but security risk increases as malicious macros can infect systems
Solution Approach 1:
The patent performs preliminary analysis of macro functions by constructing call graphs and calculating maliciousness scores before the macro executes. This preliminary detection allows the system to identify and block malicious macros while permitting legitimate automated macros to run, thus maintaining automation capability while reducing security risk
Solution Approach 2:
The system implements feedback by continuously monitoring macro execution patterns and updating detection models based on new threats. The graph neural network learns from detected malicious patterns and improves its ability to distinguish between legitimate and malicious automation, allowing the system to maintain high automation capability while adapting to new security threats
3Difficulty of detecting and measuring
If code obfuscation is applied to macros, then detection difficulty increases, but the macro functionality remains intact
Solution Approach 1:
Instead of analyzing the obfuscated code directly, the patent inverts the approach by analyzing the call graph structure and function relationships, which remain intact despite obfuscation. The system looks at how functions interact and call each other rather than focusing on the specific implementation details that are obfuscated, thereby detecting malicious patterns without being affected by code obfuscation techniques
Data Source
AI summary
A method and system are provided for detecting malicious code using graph neural networks. A call graph is created from the computer code by identifying functions in the computer code and vectorizing the identified functions using a stream of application programming interfaces (APIs) called by the functions and using tokens generated for the functions using a byte pair tokenizer. A trained graph neural network (GNN) and a trained attention neural network are applied to the call graph to generate an output graph with each node representing a function and each node assigned weights based on a probability distribution of the maliciousness of the corresponding function. A graph embedding is generated by calculating a weighted sum of the assigned weights and a trained deep neural network is applied to the graph embedding to generate a malicious score for the computer code identifying the computer code as malicious or benign.