Dynamic Malware Detection Method Based on Graph Neural Networks

In recent years, the rapid evolution of malware has posed severe challenges to cybersecurity. Traditional machine learning<sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">[1]-[2]</sup> (ML)-based methods exhibit limitations in malware classification due to their difficulty in modeling complex real-world malware characteristics and propagation networks<sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">[3]-[4]</sup>. With the application of graph mining techniques, researchers have begun leveraging graph structures to capture correlations within malware propagation networks for more efficient classification tasks<sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">[5]-[6]</sup>. Summarizing existing graph-based solutions for malware classification holds significant guidance value for future research. As a key contribution of this study, this paper provides a comprehensive survey on graph-based malware classification, including an overview of malware classification tasks, typical graph mining techniques and their application processes, and diverse solutions tailored to different classification objectives<sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">[7]-[8]</sup>. For each task, we delve into relevant methodologies, emphasizing their employed graph types, graph mining approaches, and task-level impacts. Furthermore, we organize open datasets and toolkits for graph-based malware classification and propose future research directions in this field<sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">[5]</sup>.