Dynamic Malware Detection Method Based on Graph Neural Networks

In recent years, the rapid evolution of malware has posed severe challenges to cybersecurity. Traditional machine learning^[1]-[2] (ML)-based methods exhibit limitations in malware classification due to their difficulty in modeling complex real-world malware characteristics and propagation networks^[3]-[4]. With the application of graph mining techniques, researchers have begun leveraging graph structures to capture correlations within malware propagation networks for more efficient classification tasks^[5]-[6]. Summarizing existing graph-based solutions for malware classification holds significant guidance value for future research. As a key contribution of this study, this paper provides a comprehensive survey on graph-based malware classification, including an overview of malware classification tasks, typical graph mining techniques and their application processes, and diverse solutions tailored to different classification objectives^[7]-[8]. For each task, we delve into relevant methodologies, emphasizing their employed graph types, graph mining approaches, and task-level impacts. Furthermore, we organize open datasets and toolkits for graph-based malware classification and propose future research directions in this field^[5].