Some Improvements of Behavioral Malware Detection Method Using Graph Neural Networks

This study proposes improvements to a behavioral malware detection method based on graph convolutional networks (GCNs). Three main modifications were investigated: improved normalization of the adjacency matrix, a multi-layer GCN architecture, and a parallel dual-normalization model. The models were trained on a dataset of 44,000 Windows API call sequences and evaluated using standard metrics—accuracy, precision, recall, F1 score, and ROC AUC. The best performance was achieved by the four-layer GCN, which outperformed the baseline in most metrics. The results also showed a non-monotonic relationship between model quality and network depth, likely caused by over-smoothing effects. This study confirms that properly tuned GCN architectures can significantly improve the accuracy and robustness of malware detection.