Semantic and structural fusion for malware detection: Leveraging CodeBERT, GraphCodeBERT, and AST-GCN

초록

In recent years, advances in the Internet and information and communication technologies have made malware activity in cyberspace more sophisticated and diversified. In particular, JavaScript is the most commonly used web scripting language, which can be executed directly in web browsers, making it a potential security threat. However, traditional malware detection tools are limited by their inability to respond quickly to code changes and variants. In this study, we aim to develop a robust model against malware variants and newly emerging malicious code by leveraging a language model trained on diverse programming code, incorporating contextual information, data flow, and syntactic structures. For that, we adopt CodeBERT and GraphCodeBERT. In addition, we propose a model that can understand the grammatical and structural aspects of code by taking abstract syntax tree based edge graph information as input and combining it with graph convolutional network (GCN). Moreover, we propose a multi-modal model that combines GCN, CodeBERT, and GraphCodeBERT and reflect the importance of each model using the attention. This maximizes the strengths and compensates for the weaknesses of each model. The experimental results show that the proposed model has high accuracy and efficiency even on new malicious datasets, especially more recent and more obfuscated dataset. This study is expected to contribute to the construction of a safe Internet environment in the digital age.

키워드