Malware poses an ever-growing threat to organizations, governments, and institutions. To effectively combat its proliferation and development by threat actors, identifying the authors of malware is a crucial step. Existing efforts in malware authorship attribution often focus on extracting stylistic features from source code. However, malware source code is frequently limited in availability. There is a strong need to develop effective methods to directly extract a robust and salient representation from malware binaries. This representation should adeptly capture the inherent characteristics of the binaries to facilitate the identification of malware authors. In our work, we introduce an approach that leverages multi-view graph representation learning for malware authorship attribution. We extract various intermediate representations from the binary, including control flow graphs and function call graphs. These representations are encoded using GNN-based functions and fused to create a comprehensive malware representation. Additionally, we introduce GNN-explainability approaches to identify subgraphs indicative of class membership. Our experiments on a recent benchmark demonstrate significant performance enhancements in authorship attribution.

Malicious cybersecurity activities have become increasingly worrisome for individuals and companies alike. While machine learning methods like Graph Neural Networks (GNNs) have proven successful on the malware detection task, their output is often difficult to understand. Explainable malware detection methods are needed to automatically identify malicious programs and present results to malware analysts in a way that is human interpretable. In this survey, we outline a number of GNN explainability methods and compare their performance on a real-world malware detection dataset. Specifically, we formulated the detection problem as a graph classification problem on the malware Control Flow Graphs (CFGs). We find that gradient-based methods outperform perturbation-based methods in terms of computational expense and performance on explainer-specific metrics (e.g., Fidelity and Sparsity). Our results provide insights into designing new GNN-based models for cyber malware detection and attribution.