Malware classification with detailed behavior tracing in code
Behavior-Centric Malware Classification with Fine-Grained Malicious Logic Localization
Cryptography and Security
Summary
Deciding if a computer program is bad is not enough; it's important to know what bad actions it does and where in the program. The authors created a method that breaks down harmful programs into their behaviors and finds the exact small pieces of code responsible for them. They use smart techniques to read code and show connections inside the program, then combine this info to accurately label malware and explain why. Their work helps understand malware better by showing both what it does and where the actions come from.
What this means in practice
- •For cybersecurity analysts: Identify specific malicious code segments in malware samples to prioritize investigation and mitigation efforts more effectively.
- •For security software developers: Integrate behavior-level malware detection techniques to enhance antivirus tools with interpretable alerts tied to detailed code regions.$Commercial implications: Enables building advanced antivirus products that explain detected threats by pinpointing malicious code within software.
Authors
Prakriti Baral, Zhuoyun Qian, Hailu Xu, Fangtian Zhong
Abstract
Effective malware analysis requires understanding not only whether a program is malicious, but also which behaviors it exhibits and where those behaviors originate in the code. Existing machine-learning-based malware detectors largely operate as black boxes, providing limited insight into the malicious logic responsible for their decisions. This paper addresses malicious behavior localization and classification at the basic-block level. We propose a behavior-centric analysis framework that decomposes malware samples into behaviors and systematically links these behaviors to their originating code regions. Using context-sensitive backward slicing from security-relevant system API calls, we reconstruct control- and data-dependency chains and represent each behavior as a structured graph of related basic blocks. A Transformer-based model captures instruction-level semantics, while a Graph Neural Network models structural dependencies within behavior graphs. The resulting representations are fused to enable accurate and interpretable classification, with attention-based attribution identifying code regions responsible for malicious behaviors. We evaluate our approach using standard classification metrics and a behavior coverage metric that measures the detection of manually labeled malicious behaviors. Our results demonstrate that the proposed framework achieves accurate malware classification while providing fine-grained, behavior-aware localization of malicious logic.