BejaGNN: behavior-based Java malware detection via graph neural network.

As a popular platform-independent language, Java is widely used in enterprise applications. In the past few years, language vulnerabilities exploited by Java malware have become increasingly prevalent, which cause threats for multi-platform. Security researchers continuously propose various approaches for fighting against Java malware programs. The low code path coverage and poor execution efficiency of dynamic analysis limit the large-scale application of dynamic Java malware detection methods. Therefore, researchers turn to extracting abundant static features to implement efficient malware detection. In this paper, we explore the direction of capturing malware semantic information by using graph learning algorithms and present BejaGNN (Behavior-based Java malware detection via Graph Neural Network), a novel behavior-based Java malware detection method using static analysis, word embedding technique, and graph neural network. Specifically, BejaGNN leverages static analysis techniques to extract ICFGs (Inter-procedural Control Flow Graph) from Java program files and then prunes these ICFGs to remove noisy instructions. Then, word embedding techniques are adopted to learn semantic representations for Java bytecode instructions. Finally, BejaGNN builds a graph neural network classifier to determine the maliciousness of Java programs. Experimental results on a public Java bytecode benchmark demonstrate that BejaGNN achieves high F1 98.8% and is superior to existing Java malware detection approaches, which verifies the promise of graph neural network in Java malware detection.

Comparative effectiveness and safety of bolus vs. continuous infusion of loop diuretics: Results from the MIMIC-III Database.

BACKGROUND: It is unclear whether fluid management goals are best achieved by bolus injection or continuous infusion of loop diuretics. In this study, we compared the effectiveness and safety of a continuous infusion with that of a bolus injection when an increased loop diuretic dosage is required in intensive care unit (ICU) patients. METHODS: We obtained data from the MIMIC-III database for patients who were first-time ICU admissions and required an increased diuretic dosage. Patients were excluded if they had an estimated glomerular filtration rate <15 ml/min/1.73 m2, were receiving renal replacement therapy, had a baseline systolic blood pressure <80 mmHg, or required a furosemide dose <120 mg. The patients were divided into a continuous group and a bolus group. Propensity score matching was used to balance patients' background characteristics. RESULTS: The final dataset included 807 patients (continuous group, n = 409; bolus group, n = 398). After propensity score matching, there were 253 patients in the bolus group and 231 in the continuous group. The 24 h urine output per 40 mg of furosemide was significantly greater in the continuous group than in the bolus group (234.66 ml [95% confidence interval (CI) 152.13-317.18, p < 0.01]). There was no significant between-group difference in the incidence of acute kidney injury (odds ratio 0.96, 95% CI 0.66-1.41, p = 0.85). CONCLUSIONS: Our results indicate that a continuous infusion of loop diuretics may be more effective than a bolus injection and does not increase the risk of acute kidney injury in patients who need an increased diuretic dosage in the ICU.