Malware Detection in Virtualized Environments Through API Call Graph Analysis

With the widespread adoption of virtualization tech nology in cloud and edge computing, traditional malware detection methods face significant challenges due to the complexity of dynamic virtual environments. This paper proposes a malware detection approach based on Graph Neural Networks (GNNs) in virtual environments. Specifically, we execute sample software binaries within virtual machines, extract their API call sequences, and trans-form them into graph-structured representations for malware detection and classification using GNNs. Experimental results demonstrate the superior performance of our approach when evaluated on a dataset comprising over 8.8k malware samples across seven different categories and more than 5.5k benign samples. This study provides a comprehensive description of the detection pipeline, including the construction of API call graphs, feature extraction, GNN model design and training, as well as experimental setup and result analysis. The findings indicate that our method achieves high detection accuracy and low false positive rates while effectively operating in complex and dynamic virtual environments. The proposed approach not only holds significant theoretical value but also has broad potential for practical applications.