Securing software installation through deep graph learning

1. A computer-implemented method for securing software installation through deep graph learning, comprising:

extracting a new software installation graph (SIG) corresponding to a new software installation based on installation data associated with the new software installation, the new SIG having nodes representing system subjects and objects and edges recording interactions between the system subjects and objects, wherein extracting the new SIG further includes running a backtracking process by:

iteratively backtracking through all past system events to find relevant system events;

constructing at least one preprocessed SIG describing at least a partial software installation instance by converting and mapping each system event into a component of the at least one SIG; and

performing postprocessing on the at least one preprocessed SIG to generate the at least one SIG, including storing the at least one preprocessed SIG in a graph database and merging all relevant graphs that share common nodes stored in the graph database to generate at least one merged graph corresponding to the new SIG;

using at least two node embedding models to generate a first vector representation by embedding the nodes of the new SIG and inferring any embeddings for out-of-vocabulary (OOV) words corresponding to unseen pathnames;

utilizing a deep graph autoencoder including a graph long short-term memory (LSTM) as an encoder and a multilayer perceptron (MLP) as a decoder to reconstruct nodes of the new SIG from latent vector representations encoded by the graph LSTM, wherein reconstruction losses resulting from a difference of a second vector representation generated by the deep graph autoencoder and the first vector representation represent anomaly scores for each node; and

performing anomaly detection by comparing an overall anomaly score of the anomaly scores to a threshold of normal software installation.

2. The method as recited in claim 1 , further comprising:

identifying a starting point of the backtracking by finding events of a process writing a binary file or renaming a file into a binary file; and

terminating the backtracking based on a set of stop criteria, wherein the postprocessing is performed in response to the termination.

3. The method as recited in claim 1 , further comprising utilizing a model training and validation process, including:

extracting at least one training SIG corresponding to at least one software installation based on training data to obtain a complete set of graphs;

dividing the complete set of graphs into a training set and a validation set;

learning the node embedding models from the training set using random walks and pathname components, including randomly sampling individual paths to a configurable length from the at least one training SIG to generate training data including the individual paths;

training the deep graph autoencoder to reconstruct normal process nodes and minimize reconstruction losses between the encoder and the decoder; and

using validation data of the validation set to verify model performance and determine the threshold of normal software installation using the reconstruction losses.

4. The method as recited in claim 3 , wherein training the deep graph autoencoder further includes vectorizing the at least one training SIG based on the node embedding models to generate at least one vectorized SIG.

5. The method as recited in claim 3 , wherein training the deep graph autoencoder further includes:

feeding the at least one training SIG into the encoder by topological order of edges to generate an output including a latent vector representation on each process node of the at least one training SIG; and

transferring the output to the decoder to reconstruct an original vector representation on each process node.

6. The method as recited in claim 1 , wherein performing the anomaly detection further includes:

determining that the overall anomaly score exceeds the threshold of normal software installation;

classifying the new software installation as abnormal in response to determining that the overall anomaly score exceeds the threshold of normal software installation; and

generating results of the software installation detection including a list of most suspicious processes of the new software installation sorted by respective anomaly scores.

7. The method as recited in claim 6 , wherein performing the anomaly detection further includes selecting the node embedding model and the deep graph model from the installation behavior models database based on installed files associated with the new software installation.

8. A computer program product comprising a non-transitory computer readable storage medium having program instructions embodied therewith, the program instructions executable by a computer to cause the computer to perform a method for securing software installation through deep graph learning, the method performed by the computer comprising:

extracting a new software installation graph (SIG) corresponding to a new software installation based on installation data associated with the new software installation, the new SIG having nodes representing system subjects and objects and edges recording interactions between the system subjects and objects, wherein extracting the new SIG further includes running a backtracking process by:

iteratively backtracking through all past system events to find relevant system events;

constructing at least one preprocessed SIG describing at least a partial software installation instance by converting and mapping each system event into a component of the at least one SIG; and

performing postprocessing on the at least one preprocessed SIG to generate the at least one SIG, including storing the at least one preprocessed SIG in a graph database and merging all relevant graphs that share common nodes stored in the graph database to generate at least one merged graph corresponding to the new SIG;

using at least two node embedding models to generate a first vector representation by embedding the nodes of the new SIG and inferring any embeddings for out-of-vocabulary (OOV) words corresponding to unseen pathnames;

utilizing a deep graph autoencoder including a graph long short-term memory (LSTM) as an encoder and a multilayer perceptron (MLP) as a decoder to reconstruct nodes of the new SIG from latent vector representations encoded by the graph LSTM, wherein reconstruction losses resulting from a difference of a second vector representation generated by the deep graph autoencoder and the first vector representation represent anomaly scores for each node; and

performing anomaly detection by comparing an overall anomaly score of the anomaly scores to a threshold of normal software installation.

9. The computer program product as recited in claim 8 , wherein the method further includes utilizing a model training and validation process, including:

extracting at least one training SIG corresponding to at least one software installation based on training data to obtain a complete set of graphs;

dividing the complete set of graphs into a training set and a validation set;

learning the node embedding models from the training set using random walks and pathname components, including randomly sampling individual paths to a configurable length from the at least one training SIG to generate training data including the individual paths;

training the deep graph autoencoder to reconstruct normal process nodes and minimize reconstruction losses between the encoder and the decoder; and

using validation data of the validation set to verify model performance and determine the threshold of normal software installation using the reconstruction losses.

10. The computer program product as recited in claim 9 , wherein training the deep graph autoencoder further includes vectorizing the at least one training SIG based on the node embedding models to generate at least one vectorized SIG.

11. The computer program product as recited in claim 9 , wherein training the deep graph autoencoder further includes:

feeding the at least one training SIG into the encoder by topological order of edges to generate an output including a latent vector representation on each process node of the at least one training SIG; and

transferring the output to the decoder to reconstruct an original vector representation on each process node.

12. The computer program product as recited in claim 8 , wherein performing the anomaly detection further includes:

determining that the overall anomaly score exceeds the threshold of normal software installation;

classifying the new software installation as abnormal in response to determining that the overall anomaly score exceeds the threshold of normal software installation; and

generating results of the software installation detection including a list of most suspicious processes of the new software installation sorted by respective anomaly scores; and

selecting the node embedding model and the deep graph model from the installation behavior models database based on installed files associated with the new software installation.

13. A system for securing software installation through deep graph learning, comprising:

a memory device storing program code; and

at least one processor device operatively coupled to the memory device and configured to execute program code stored on the memory device to:

extract a new software installation graph (SIG) corresponding to a new software installation based on installation data associated with the new software installation, the new SIG having nodes representing system subjects and objects and edges recording interactions between the system subjects and objects, wherein the at least one processor device is configured to extract the new SIG further by running a backtracking process by:

iteratively backtracking through all past system events to find relevant system events;

constructing at least one preprocessed SIG describing at least a partial software installation instance by converting and mapping each system event into a component of the at least one SIG; and

performing postprocessing on the at least one preprocessed SIG to generate the at least one SIG, including storing the at least one preprocessed SIG in a graph database and merging all relevant graphs that share common nodes stored in the graph database to generate at least one merged graph corresponding to the new SIG;

use at least two node embedding models to generate a first vector representation by embedding the nodes of the new SIG and inferring any embeddings for out-of-vocabulary (OOV) words corresponding to unseen pathnames;

utilize a deep graph autoencoder including a graph long short-term memory (LSTM) as an encoder and a multilayer perceptron (MLP) as a decoder to reconstruct nodes of the new SIG from latent vector representations encoded by the graph LSTM, wherein reconstruction losses resulting from a difference of a second vector representation generated by the deep graph autoencoder and the first vector representation represent anomaly scores for each node; and

perform anomaly detection by comparing an overall anomaly score of the anomaly scores to a threshold of normal software installation.

14. The system as recited in claim 13 , wherein the at least one processor device is further configured to execute program code stored on the memory device to utilize a model training and validation process by:

extracting at least one training SIG corresponding to at least one software installation based on training data to obtain a complete set of graphs;

dividing the complete set of graphs into a training set and a validation set;

learning the node embedding models from the training set using random walks and pathname components, including randomly sampling individual paths to a configurable length from the at least one training SIG to generate training data including the individual paths;

training the deep graph autoencoder to reconstruct normal process nodes and minimize reconstruction losses between the encoder and the decoder; and

using validation data of the validation set to verify model performance and determine the threshold of normal software installation using the reconstruction losses.

15. The system as recited in claim 14 , wherein the at least one processor device is further configured to train the deep graph autoencoder by vectorizing the at least one training SIG based on the node embedding models to generate at least one vectorized SIG.

16. The system as recited in claim 14 , wherein the at least one processor device is further configured to train the deep graph autoencoder by:

feeding the at least one training SIG into the encoder by topological order of edges to generate an output including a latent vector representation on each process node of the at least one training SIG; and

transferring the output to the decoder to reconstruct an original vector representation on each process node.

17. The system as recited in claim 13 , wherein the at least one processor device is further configured to perform the anomaly detection by:

determining that the overall anomaly score exceeds the threshold of normal software installation;

classifying the new software installation as abnormal in response to determining that the overall anomaly score exceeds the threshold of normal software installation; and

generating results of the software installation detection including a list of most suspicious processes of the new software installation sorted by respective anomaly scores; and

selecting the node embedding model and the deep graph model from the installation behavior models database based on installed files associated with the new software installation.