Behavior-Centric Malware Classification with Fine-Grained Malicious Logic Localization
The framework analyzes malware by breaking it down into behaviors and mapping them to specific code regions. It uses static and dynamic analysis to find suspicious actions, assigns scores based on these behaviors, and then feeds these scores into a dual deep learning model combining a Transformer for sequences and a Graph Neural Network for structure. This allows for accurate classification while explaining exactly which code parts cause the malicious behavior.