Detecting Malware with Graph Neural Networks
Anomalous activity is detected within an enterprise system. There are no files left behind, and very few logs remain—yet sensitive data has been exfiltrated.
And still, no known malware signature has been triggered.
※ Signature: A unique pattern or characteristic of known malware, such as specific command sequences or byte-level structures.
Fileless malware—those that do not leave behind traditional files—are no longer exceptions. They are becoming a representative threat that evades conventional detection systems.
So, what if we approached malware not just as files, but as graphs?
Check out a malware detection study[1] that leverages graph machine learning (GNN) and network structures between malware scripts to improve detection accuracy.
By modeling the similarity between command-based malware scripts as graph structures,
the researchers achieved higher accuracy and better detection performance than traditional methods
Background
Challenges in Detecting New Malware
As fileless malware increases, detection methods based on fixed signatures are revealing their limitations. In particular, malware that leverages scripting languages like PowerShell leaves minimal traces, making it extremely difficult for traditional static analysis tools to identify them. To address these challenges, a new approach beyond pre-defined signatures is required—one that can adapt to unknown and evolving threats.
Core Idea
Detecting Malware Through Script Similarity Networks
This research analyzes how similar the command sequences are between PowerShell scripts, and constructs a network graph based on that similarity. Then, it applies a Graph Neural Network (GNN) to this graph to predict whether each script is malicious or benign.
A Graph Neural Network is a model that learns not only the attributes of each entity (node), but also the information from its connected neighbors and the structure of their relationships.
In short: "My identity is shaped not just by me, but by who I’m connected to."
Solution
Step 1. Structuring Script Networks
First, command sequences are extracted from PowerShell malware scripts.
Below is a conceptual visualization of how script–sequence relationships can be modeled as a graph.
Since the same sequence may appear in multiple scripts, the Jaccard Coefficient is used to measure the degree of overlap and define similarity between scripts.
For example, if Script 1 and Script 2 both include Sequences A and D, they are considered highly similar and connected in the image.
Step 2. Training the Graph Neural Network
To evaluate each script’s maliciousness, the researchers trained a GNN using both:
- Individual script characteristics (i.e., their command sequences), and - The structure of how each script is connected to other malicious scripts.
This allowed the model to detect new forms of malware by analyzing their relationships to known malicious patterns, even when no prior information about the new variant existed.
For comparison, two baseline models were built:
-
A CNN model trained only on script attributes
-
A GCN(Identity Matrix) model using graph structure without similarity weighting
Result
Improving Detection Accuracy with Graph Structures
The result? The GNN-based model outperformed both baselines in malware detection accuracy.
As digital infrastructure grows more sophisticated and malware evolves into fileless, stealthy forms, it becomes increasingly difficult for signature-based systems to keep up.
By modeling the relationships between scripts as a graph, this approach offers the flexibility to adapt to changing attack patterns, reduces blind spots in detection, and improves operational efficiency.
Ultimately, it can serve as a strategic enabler in building more resilient and intelligent cybersecurity systems.
NetMiner Team
netminer@cyram.com
References
[1] Park, Y.-H., Kim, B.-H., & Choi, S. (2021).
A Study for Detecting Malware Using GCN. Annual Conference of KIPS, 213–216. https://doi.org/10.3745/PKIPS.Y2021M11A.213