Residual Community Prototypes Under-Reject Held-Out Malware Families in FCG-MFD
Study finds Louvain community features fail to stably reject held-out malware families in FCG-based open-set recognition versus simple uncertainty.
The paper tests whether residualized Louvain-community summaries add rejection capability beyond a GIN embedding and dimension-matched generic topology on a deduplicated, conflict-audited FCG-MFD corpus with five held-out families. Community features did not produce stable held-out-family rejection: ranking effects reversed across families, false-positive rate at 95% unknown recall worsened for every family, and a validation-fitted threshold rejected only 4.48% of unknown samples. Accepted-known macro F1 improved in every family but the exact two-sided sign-flip p-value was 0.0625. Simple classifier uncertainty performed better on ranking, high-recall rejection, and OSCR, motivating matched topology controls and held-out-family analysis in graph open-set evaluations.
- Residual community prototypes fail to create a stable unknown margin for held-out families.
- Validation-fitted threshold rejects only 4.48% of unknown samples.
- Known-family macro F1 gains are statistically inconclusive (p=0.0625, n=5).
- Simple classifier uncertainty outperforms on ranking, high-recall rejection, and OSCR.
From the original article
1 min read at arxiv.orgOpen-set malware-family recognition must classify known families while rejecting families absent from training. We test whether Louvain-community summaries add rejection information beyond a graph neural network embedding and dimension-matched generic topology. The study uses a deduplicated, conflict-audited FCG-MFD corpus, five held-out families, and three optimization seeds.
By Junru Zhu · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.