A Survey of Explainable Graph Neural Networks for Cyber Malware Analysis

Dana Warmsley; Alex Waagen; Jiejun Xu; Zhining Liu; Hanghang Tong

doi:10.1109/BigData55660.2022.10020943

A Survey of Explainable Graph Neural Networks for Cyber Malware Analysis

Dana Warmsley, Alex Waagen, Jiejun Xu, Zhining Liu, Hanghang Tong

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution

Abstract

Malicious cybersecurity activities have become increasingly worrisome for individuals and companies alike. While machine learning methods like Graph Neural Networks (GNNs) have proven successful on the malware detection task, their output is often difficult to understand. Explainable malware detection methods are needed to automatically identify malicious programs and present results to malware analysts in a way that is human interpretable. In this survey, we outline a number of GNN explainability methods and compare their performance on a real-world malware detection dataset. Specifically, we formulated the detection problem as a graph classification problem on the malware Control Flow Graphs (CFGs). We find that gradient-based methods outperform perturbation-based methods in terms of computational expense and performance on explainer-specific metrics (e.g., Fidelity and Sparsity). Our results provide insights into designing new GNN-based models for cyber malware detection and attribution.

Original language	English (US)
Title of host publication	Proceedings - 2022 IEEE International Conference on Big Data, Big Data 2022
Editors	Shusaku Tsumoto, Yukio Ohsawa, Lei Chen, Dirk Van den Poel, Xiaohua Hu, Yoichi Motomura, Takuya Takagi, Lingfei Wu, Ying Xie, Akihiro Abe, Vijay Raghavan
Publisher	Institute of Electrical and Electronics Engineers Inc.
Pages	2932-2939
Number of pages	8
ISBN (Electronic)	9781665480451
DOIs	https://doi.org/10.1109/BigData55660.2022.10020943
State	Published - 2022
Event	2022 IEEE International Conference on Big Data, Big Data 2022 - Osaka, Japan Duration: Dec 17 2022 → Dec 20 2022

Publication series

Name	Proceedings - 2022 IEEE International Conference on Big Data, Big Data 2022

Conference

Conference	2022 IEEE International Conference on Big Data, Big Data 2022
Country/Territory	Japan
City	Osaka
Period	12/17/22 → 12/20/22

Keywords

Classification
Cybersecurity
Explainability
Graph Neural Networks
Machine Learning
Malware

ASJC Scopus subject areas

Modeling and Simulation
Computer Networks and Communications
Information Systems
Information Systems and Management
Safety, Risk, Reliability and Quality
Control and Optimization

Online availability

10.1109/BigData55660.2022.10020943

Library availability

Discover UIUC Full Text

Cite this

Warmsley, D., Waagen, A., Xu, J., Liu, Z., & Tong, H. (2022). A Survey of Explainable Graph Neural Networks for Cyber Malware Analysis. In S. Tsumoto, Y. Ohsawa, L. Chen, D. Van den Poel, X. Hu, Y. Motomura, T. Takagi, L. Wu, Y. Xie, A. Abe, & V. Raghavan (Eds.), Proceedings - 2022 IEEE International Conference on Big Data, Big Data 2022 (pp. 2932-2939). (Proceedings - 2022 IEEE International Conference on Big Data, Big Data 2022). Institute of Electrical and Electronics Engineers Inc.. https://doi.org/10.1109/BigData55660.2022.10020943

A Survey of Explainable Graph Neural Networks for Cyber Malware Analysis. / Warmsley, Dana; Waagen, Alex; Xu, Jiejun et al.
Proceedings - 2022 IEEE International Conference on Big Data, Big Data 2022. ed. / Shusaku Tsumoto; Yukio Ohsawa; Lei Chen; Dirk Van den Poel; Xiaohua Hu; Yoichi Motomura; Takuya Takagi; Lingfei Wu; Ying Xie; Akihiro Abe; Vijay Raghavan. Institute of Electrical and Electronics Engineers Inc., 2022. p. 2932-2939 (Proceedings - 2022 IEEE International Conference on Big Data, Big Data 2022).

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution

Warmsley, D, Waagen, A, Xu, J, Liu, Z & Tong, H 2022, A Survey of Explainable Graph Neural Networks for Cyber Malware Analysis. in S Tsumoto, Y Ohsawa, L Chen, D Van den Poel, X Hu, Y Motomura, T Takagi, L Wu, Y Xie, A Abe & V Raghavan (eds), Proceedings - 2022 IEEE International Conference on Big Data, Big Data 2022. Proceedings - 2022 IEEE International Conference on Big Data, Big Data 2022, Institute of Electrical and Electronics Engineers Inc., pp. 2932-2939, 2022 IEEE International Conference on Big Data, Big Data 2022, Osaka, Japan, 12/17/22. https://doi.org/10.1109/BigData55660.2022.10020943

Warmsley D, Waagen A, Xu J, Liu Z, Tong H. A Survey of Explainable Graph Neural Networks for Cyber Malware Analysis. In Tsumoto S, Ohsawa Y, Chen L, Van den Poel D, Hu X, Motomura Y, Takagi T, Wu L, Xie Y, Abe A, Raghavan V, editors, Proceedings - 2022 IEEE International Conference on Big Data, Big Data 2022. Institute of Electrical and Electronics Engineers Inc. 2022. p. 2932-2939. (Proceedings - 2022 IEEE International Conference on Big Data, Big Data 2022). doi: 10.1109/BigData55660.2022.10020943

Warmsley, Dana ; Waagen, Alex ; Xu, Jiejun et al. / A Survey of Explainable Graph Neural Networks for Cyber Malware Analysis. Proceedings - 2022 IEEE International Conference on Big Data, Big Data 2022. editor / Shusaku Tsumoto ; Yukio Ohsawa ; Lei Chen ; Dirk Van den Poel ; Xiaohua Hu ; Yoichi Motomura ; Takuya Takagi ; Lingfei Wu ; Ying Xie ; Akihiro Abe ; Vijay Raghavan. Institute of Electrical and Electronics Engineers Inc., 2022. pp. 2932-2939 (Proceedings - 2022 IEEE International Conference on Big Data, Big Data 2022).

@inproceedings{d41c212c51a94a6696bd783058312405,

title = "A Survey of Explainable Graph Neural Networks for Cyber Malware Analysis",

abstract = "Malicious cybersecurity activities have become increasingly worrisome for individuals and companies alike. While machine learning methods like Graph Neural Networks (GNNs) have proven successful on the malware detection task, their output is often difficult to understand. Explainable malware detection methods are needed to automatically identify malicious programs and present results to malware analysts in a way that is human interpretable. In this survey, we outline a number of GNN explainability methods and compare their performance on a real-world malware detection dataset. Specifically, we formulated the detection problem as a graph classification problem on the malware Control Flow Graphs (CFGs). We find that gradient-based methods outperform perturbation-based methods in terms of computational expense and performance on explainer-specific metrics (e.g., Fidelity and Sparsity). Our results provide insights into designing new GNN-based models for cyber malware detection and attribution.",

keywords = "Classification, Cybersecurity, Explainability, Graph Neural Networks, Machine Learning, Malware",

author = "Dana Warmsley and Alex Waagen and Jiejun Xu and Zhining Liu and Hanghang Tong",

note = "Publisher Copyright: {\textcopyright} 2022 IEEE.; 2022 IEEE International Conference on Big Data, Big Data 2022 ; Conference date: 17-12-2022 Through 20-12-2022",

year = "2022",

doi = "10.1109/BigData55660.2022.10020943",

language = "English (US)",

series = "Proceedings - 2022 IEEE International Conference on Big Data, Big Data 2022",

publisher = "Institute of Electrical and Electronics Engineers Inc.",

pages = "2932--2939",

editor = "Shusaku Tsumoto and Yukio Ohsawa and Lei Chen and {Van den Poel}, Dirk and Xiaohua Hu and Yoichi Motomura and Takuya Takagi and Lingfei Wu and Ying Xie and Akihiro Abe and Vijay Raghavan",

booktitle = "Proceedings - 2022 IEEE International Conference on Big Data, Big Data 2022",

address = "United States",

}

TY - GEN

T1 - A Survey of Explainable Graph Neural Networks for Cyber Malware Analysis

AU - Warmsley, Dana

AU - Waagen, Alex

AU - Xu, Jiejun

AU - Liu, Zhining

AU - Tong, Hanghang

PY - 2022

Y1 - 2022

N2 - Malicious cybersecurity activities have become increasingly worrisome for individuals and companies alike. While machine learning methods like Graph Neural Networks (GNNs) have proven successful on the malware detection task, their output is often difficult to understand. Explainable malware detection methods are needed to automatically identify malicious programs and present results to malware analysts in a way that is human interpretable. In this survey, we outline a number of GNN explainability methods and compare their performance on a real-world malware detection dataset. Specifically, we formulated the detection problem as a graph classification problem on the malware Control Flow Graphs (CFGs). We find that gradient-based methods outperform perturbation-based methods in terms of computational expense and performance on explainer-specific metrics (e.g., Fidelity and Sparsity). Our results provide insights into designing new GNN-based models for cyber malware detection and attribution.

AB - Malicious cybersecurity activities have become increasingly worrisome for individuals and companies alike. While machine learning methods like Graph Neural Networks (GNNs) have proven successful on the malware detection task, their output is often difficult to understand. Explainable malware detection methods are needed to automatically identify malicious programs and present results to malware analysts in a way that is human interpretable. In this survey, we outline a number of GNN explainability methods and compare their performance on a real-world malware detection dataset. Specifically, we formulated the detection problem as a graph classification problem on the malware Control Flow Graphs (CFGs). We find that gradient-based methods outperform perturbation-based methods in terms of computational expense and performance on explainer-specific metrics (e.g., Fidelity and Sparsity). Our results provide insights into designing new GNN-based models for cyber malware detection and attribution.

KW - Classification

KW - Cybersecurity

KW - Explainability

KW - Graph Neural Networks

KW - Machine Learning

KW - Malware

UR - http://www.scopus.com/inward/record.url?scp=85147960136&partnerID=8YFLogxK

UR - http://www.scopus.com/inward/citedby.url?scp=85147960136&partnerID=8YFLogxK

U2 - 10.1109/BigData55660.2022.10020943

DO - 10.1109/BigData55660.2022.10020943

M3 - Conference contribution

AN - SCOPUS:85147960136

T3 - Proceedings - 2022 IEEE International Conference on Big Data, Big Data 2022

SP - 2932

EP - 2939

BT - Proceedings - 2022 IEEE International Conference on Big Data, Big Data 2022

A2 - Tsumoto, Shusaku

A2 - Ohsawa, Yukio

A2 - Chen, Lei

A2 - Van den Poel, Dirk

A2 - Hu, Xiaohua

A2 - Motomura, Yoichi

A2 - Takagi, Takuya

A2 - Wu, Lingfei

A2 - Xie, Ying

A2 - Abe, Akihiro

A2 - Raghavan, Vijay

PB - Institute of Electrical and Electronics Engineers Inc.

T2 - 2022 IEEE International Conference on Big Data, Big Data 2022

Y2 - 17 December 2022 through 20 December 2022

ER -

A Survey of Explainable Graph Neural Networks for Cyber Malware Analysis

Abstract

Publication series

Conference

Keywords

ASJC Scopus subject areas

Online availability

Library availability

Related links

Fingerprint

Cite this