![](bg8.png)
published on TOR website [...]". We cannot
observe data exfiltration, as it was done with low-
level methods, e.g. using special I/O API calls with
undocumented flags. Instead, we can only observe
sockets binding to all the opened interfaces without
sending anything.
All of these examples of BAGUETTE graphs
show that: 1) A global view of the dynamic traces
in the BAGUETTE graph help human analysts to
quickly focus on possibly interesting behaviours. 2)
Zooming the graph and unveiling detailed informa-
tion allows human analysts to conduct deeper investi-
gation into specific payloads and help producing ex-
planations for the malware sample’s behaviour.
6 CONCLUSION
Malware analysis consists of understanding the ob-
jective of a malware, and its various attack, pro-
tection, and evasion techniques. BAGUETTE is a
post-processing of the dynamic analysis report pro-
duced by Cuckoo sandbox relying on a heterogeneous
graph. Based on this representation, it is easy to spec-
ify metagraphs that describe suspicious behaviours
and to use them to filter a database of analysis re-
ports to highlight malware displaying a given suspi-
cious and precise behaviors. Finally, experts can use
BAGUETTE graphs to manually analyze the interac-
tion between the malware and the host and quickly
discover and verify hypotheses. In the future, we
will use metagraphs to identify clusters of malware
exhibiting partially similar behaviors and qualify un-
known malware by recognizing partially known be-
haviors through metagraphs. We will also try to create
an algorithm to learn significant metagraphs to sepa-
rate datasets of BAGUETTEs.
REFERENCES
Alptekin, H., Yildizli, C., Savas, E., and Levi, A. (2019).
TRAPDROID: Bare-Metal Android Malware Behav-
ior Analysis Framework. In 2019 21st International
Conference on Advanced Communication Technol-
ogy (ICACT), pages 664–671, PyeongChang Kwang-
woon Do, Korea (South). IEEE.
Bridges, R., Hern
´
andez Jim
´
enez, J., Nichols, J., Goseva-
Popstojanova, K., and Prowell, S. (2018). Towards
Malware Detection via CPU Power Consumption:
Data Collection Design and Analytics. In 2018
17th IEEE International Conference On Trust, Secu-
rity And Privacy In Computing And Communications/
12th IEEE International Conference On Big Data Sci-
ence And Engineering (TrustCom/BigDataSE), pages
1680–1684. ISSN: 2324-9013.
Chen, Z.-G., Kang, H.-S., Yin, S.-N., and Kim, S.-R.
(2017). Automatic Ransomware Detection and Analy-
sis Based on Dynamic API Calls Flow Graph. In Pro-
ceedings of the International Conference on Research
in Adaptive and Convergent Systems, pages 196–201,
Krakow Poland. ACM.
Ding, Y., Xia, X., Chen, S., and Li, Y. (2018). A malware
detection method based on family behavior graph.
Computers & Security, 73:73–86.
Fang, Y., Lin, W., Zheng, V. W., Wu, M., Shi, J., Chang, K.
C.-C., and Li, X.-L. (2021). Metagraph-Based Learn-
ing on Heterogeneous Graphs. IEEE Transactions on
Knowledge and Data Engineering, 33(1):154–168.
Grimmer, M., R
¨
ohling, M. M., Kricke, M., Franczyk, B.,
and Rahm, E. (2018). Intrusion detection on system
call graphs. Sicherheit in vernetzten Systemen, pages
G1–G18.
Kolosnjaji, B., Zarras, A., Webster, G., and Eckert, C.
(2016). Deep Learning for Classification of Malware
System Call Sequences. In Kang, B. H. and Bai, Q.,
editors, AI 2016: Advances in Artificial Intelligence,
volume 9992, pages 137–149. Springer International
Publishing, Cham. Series Title: Lecture Notes in
Computer Science.
Park, Y., Reeves, D., Mulukutla, V., and Sundaravel, B.
(2010). Fast malware classification by automated be-
havioral graph matching. In Proceedings of the Sixth
Annual Workshop on Cyber Security and Informa-
tion Intelligence Research - CSIIRW ’10, page 1, Oak
Ridge, Tennessee. ACM Press.
Piplai, A., Mittal, S., Abdelsalam, M., Gupta, M., Joshi, A.,
and Finin, T. (2020). Knowledge Enrichment by Fus-
ing Representations for Malware Threat Intelligence
and Behavior. In 2020 IEEE International Conference
on Intelligence and Security Informatics (ISI), pages
1–6.
Qiang, W., Yang, L., and Jin, H. (2022). Efficient and
Robust Malware Detection Based on Control Flow
Traces Using Deep Neural Networks. Computers &
Security, 122:102871.
Raff, E. and Nicholas, C. (2020). A Survey of Machine
Learning Methods and Challenges for Windows Mal-
ware Classification. NeurIPS 2020 Workshop: ML
Retrospectives, Surveys & Meta-Analyses (ML-RSA).
Sihwail, R., Omar, K., and Zainol Ariffin, K. A. (2018). A
Survey on Malware Analysis Techniques: Static, Dy-
namic, Hybrid and Memory Analysis. International
Journal on Advanced Science, Engineering and Infor-
mation Technology, 8(4-2):1662.
Wang, S., Chen, Z., Yu, X., Li, D., Ni, J., Tang, L.-A.,
Gui, J., Li, Z., Chen, H., and Yu, P. S. (2019). Het-
erogeneous Graph Matching Networks for Unknown
Malware Detection. In Proceedings of the Twenty-
Eighth International Joint Conference on Artificial In-
telligence, pages 3762–3770, Macao, China. Interna-
tional Joint Conferences on Artificial Intelligence Or-
ganization.
Wunderlich, S., Ring, M., Landes, D., and Hotho, A.
(2020). Comparison of System Call Representations
for Intrusion Detection. Springer, Cham, 951:14–24.
Xiao, F., Lin, Z., Sun, Y., and Ma, Y. (2019). Malware De-
tection Based on Deep Learning of Behavior Graphs.
Mathematical Problems in Engineering, 2019:1–10.
SECRYPT 2023 - 20th International Conference on Security and Cryptography
424