Temporal Generalization and Explanation Stability of Control Flow Graph Neural Networks for Malware Detection
Message-passing choice decides whether Windows malware-detection graph networks survive a later-year sample shift.
Researchers tested control-flow-graph neural networks for Windows malware detection using a strict temporal split rather than a random split. Twelve variants and a flat-feature control were trained on 459 graphs from 2024-2025 and scored once on 223 graphs from 2026, drawn from 1,989 portable executables with 37 node features. The message-passing operator strongly affected robustness, and the flat model that ignored topology was best in-distribution but among the worst across the time boundary. The shift hit malware and benign samples alike, so the authors frame the result as distribution-shift robustness rather than malware evolution.
- Models trained on 2024-2025 graphs were tested once on 2026 samples.
- 459 training and 223 evaluation graphs came from 1,989 Windows executables.
- Aggregating message-passing beat attentional readouts under the time shift.
- A topology-free baseline won in-distribution but ranked near worst later.
Full article248 words · extracted from arxiv.org · click to collapse
Malware detection is a critical task in cybersecurity, and graph neural networks over control flow graphs have shown promising results for it. However, detectors are usually evaluated on a random split of a corpus collected over a single period, which cannot show how well a model generalizes to later samples. This study addresses that limitation with a strict temporal split: every model is trained on one period and scored once on a later one. Two corpora of control flow graphs, each node carrying 37 features, were extracted statically from 1,989 Windows portable executables: 459 graphs from 2024-2025 for training and 223 from 2026 for evaluation. Twelve variants and a flat-feature control were trained on the earlier corpus. The choice of message-passing operator changes robustness to the shift significantly, and every pairwise gap that survives correction separates an aggregating architecture from one built around a learned attentional readout. The ranking also reverses: the flat control, which sees node features but no topology, is the best in-distribution model and among the worst across the boundary, so a conventional benchmark would have rejected message passing. Neither recalibration nor ensembling substitutes for the operator choice. Attributions do not shift, but explanation validity is architecture-specific, and the most accurate operator on the later corpus is the hardest to explain. An architecture derived from the finding matches the best searched operator without search. The shift affects both malware and benign classes alike, so these are results about robustness to distribution shift, not malware evolution.
Text extracted automatically; images, tables and formatting may be missing. Original: https://arxiv.org/abs/2609.24280