Methods and systems for malware analysis using a genetic algorithm graph explainer

A computing device configured for determining whether an executable code is a malware, the computing device comprising:

• a processor;
• and
• a memory,
• wherein the computing device is configured to:
• disassemble the executable code to create disassembled instructions;
• extract instruction blocks from the disassembled instructions;
• encode the instruction blocks to create encoded instruction blocks and generate a first data graph, wherein the first data graph comprises nodes, each node from the first data graph being associated with an encoded instruction block;
• determine for each node an embedding of the encoded instruction block to create a canonical executable graph;
• classify the canonical executable graphs into either a benign family or a malicious family;
• and
• determine that the executable code is a malware when the canonical executable graph belongs to a malicious family.

A non-transitory computer readable medium for storing instruction code, which, when executed by a processor of a computing device, cause the computing device to:

• disassemble executable code to create disassembled instructions;
• extract instruction blocks from the disassembled instructions;
• encode the instruction blocks to create encoded instruction blocks and generate a first data graph, wherein the first data graph comprises nodes, each node from the first data graph being associated with an encoded instruction block;
• determine for each node an embedding of the encoded instruction block to create a canonical executable graph;
• classify the canonical executable graphs into a benign family or a malicious family;
• and
• determine that the executable code is a malware when the canonical executable graph belongs to a malicious family.