  In today's interconnected digital landscape, the proliferation of malware
poses a significant threat to the security and stability of computer networks
and systems worldwide. As the complexity of malicious tactics, techniques, and
procedures (TTPs) continuously grows to evade detection, so does the need for
advanced methods capable of capturing and characterizing malware behavior. The
current state of the art in malware classification and detection uses task
specific objectives; however, this method fails to generalize to other
downstream tasks involving the same malware class. In this paper, the authors
introduce a novel method that combines convolutional neural networks, standard
graph embedding techniques, and a metric learning objective to extract
meaningful information from network flow data and create strong embeddings
characterizing malware behavior. These embeddings enable the development of
highly accurate, efficient, and generalizable machine learning models for tasks
such as malware strain classification, zero day threat detection, and closest
attack type attribution as demonstrated in this paper. A shift from task
specific objectives to strong embeddings will not only allow rapid iteration of
cyber-threat detection models, but also allow different modalities to be
introduced in the development of these models.
