公开(公告)号：US20240211596A1

公开(公告)日：2024-06-27

申请号：US18146092

申请日：2022-12-23

申请人： Check Point Software Technologies Ltd.

发明人： Dor Livne ,  Avner Duchovni ,  Erez Israel ,  Natan Katz ,  Michael Abramzon

IPC分类号： G06F21/56 ,  G06N3/08

CPC分类号： G06F21/563 ,  G06N3/08

摘要： A method and system are provided for detecting malicious code using graph neural networks. A call graph is created from the computer code by identifying functions in the computer code and vectorizing the identified functions using a stream of application programming interfaces (APIs) called by the functions and using tokens generated for the functions using a byte pair tokenizer. A trained graph neural network (GNN) and a trained attention neural network are applied to the call graph to generate an output graph with each node representing a function and each node assigned weights based on a probability distribution of the maliciousness of the corresponding function. A graph embedding is generated by calculating a weighted sum of the assigned weights and a trained deep neural network is applied to the graph embedding to generate a malicious score for the computer code identifying the computer code as malicious or benign.