Temporal Generalization and Explanation Stability of Control Flow Graph Neural Networks for Malware Detection
Message-passing choice decides whether Windows malware-detection graph networks survive a later-year sample shift.
Researchers tested control-flow-graph neural networks for Windows malware detection using a strict temporal split rather than a random split. Twelve variants and a flat-feature control were trained on 459 graphs from 2024-2025 and scored once on 223 graphs from 2026, drawn from 1,989 portable executables with 37 node features. The message-passing operator strongly affected robustness, and the flat model that ignored topology was best in-distribution but among the worst across the time boundary. The shift hit malware and benign samples alike, so the authors frame the result as distribution-shift robustness rather than malware evolution.
- Models trained on 2024-2025 graphs were tested once on 2026 samples.
- 459 training and 223 evaluation graphs came from 1,989 Windows executables.
- Aggregating message-passing beat attentional readouts under the time shift.
- A topology-free baseline won in-distribution but ranked near worst later.
From the original article
1 min read at arxiv.orgMalware detection is a critical task in cybersecurity, and graph neural networks over control flow graphs have shown promising results for it. However, detectors are usually evaluated on a random split of a corpus collected over a single period, which cannot show how well a model generalizes to later samples.
By Md. Asif Sajeed · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.