Skip to content

22lavonne/Malware-Behavior-Knowledge-Graph

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

158 Commits
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 

Repository files navigation

A Knowledge Graph for the Detection of Malware Behavior in Executables

Departmental Honors Thesis under Dr. Cogan Shimizu based on the intersection between Knowledge Graphs and Cyber Security.

About

This knowledge graph is based on the symbol table in Ghidra with the goal of assisting reverse engineers in detecting malicious behavior in executable files. The ontology takes the output of a decompiled file analyzed in Ghidra to encode the knowledge graph of said file to provide a graphical representation of the data connections of the file. The knowledge graph can be queried to detect malicious behavior in the file to determine if the executable is malware.

Resources:

  • Documentation: contains useful documentation of the project like key notions and an annotated bibliography of works seen during research.
  • Schema: contains a .graphml file of the schema, and images of the individual modules of the schema (used in key-notions)
  • Ontology: contains the Turtle file of the ontology.
  • Ghidra Scripting: contains any scripts used to extract the data for the knowledge graph (writen in Pyghidra).
  • Queries: contains a SPARQL file containing all the queries used in the project. Also contains CSV files containing the results of these queries when ran on a knowledge graph materialized from data of a malicious executable file.
  • Honors Blitz: contains the resources and presentation used for the Wright State 2026 Honors Blitz competition.

About

Independent study project based on the intersection between Knowledge Graphs and Cyber Security.

Resources

Stars

Watchers

Forks

Releases

No releases published

Packages

 
 
 

Contributors

Languages