Fusion of Static and Dynamic Features for Malware Detection: A Graph Neural Network Approach to Behavioral Representation and Classification

Jingyu Tang

doi:10.54254/2755-2721/2025.24689

Applied and Computational EngineeringOpen access

Fusion of Static and Dynamic Features for Malware Detection: A Graph Neural Network Approach to Behavioral Representation and Classification

Research Article

Open Access

Fusion of Static and Dynamic Features for Malware Detection: A Graph Neural Network Approach to Behavioral Representation and Classification

Jingyu Tang ^1*

¹ University of Sydney, Sydney, Australia

^*Corresponding author: rara481846778@gmail.com

Published on 4 July 2025

ACE Vol.176

ISSN (Print): 2755-273X

ISSN (Online): 2755-2721

ISBN (Print): 978-1-80590-239-3

ISBN (Online): 978-1-80590-240-9

Download Cover

Abstract

This study proposes a novel malware detection framework integrating dynamic and static analysis, and realizes the collaborative processing of bi-modal data through a unified graph neural network architecture. Specifically: extracting the control flow and data dependency features from binary disassembly, and capturing the system call sequence with time attributes in the sandbox environment; After encoding the two types of features into heterogeneous relationship graphs, a two-branch network is adopted to process the static topology (graph convolutional layer) and dynamic sequence (graph attention layer) respectively; Finally, the classification decision-making is achieved by the feature fusion module. In the benchmark test set of EMBER, VirusShare, and CIC-MalMem, the accuracy rate of the framework exceeded 95%, which is 4 to 7 percentage points higher than the single-modal baseline. The recall rate of unknown malware families remained above 92%, and the single-sample detection time was less than 50 milliseconds. The ablation experiment confirmed that static features effectively resist shell confusion and dynamic temporal attributes improve the recognition of distorted viruses. The current system has limitations on anti-sandbox detection technology. Further research suggests combining reinforcement learning to dynamically adjust the sandbox depth and introducing contractive learning to optimize the discriminative ability of graph embedding.

Keywords:

Malware Detection, Graph Neural Networks, Static Analysis, Dynamic Analysis, Feature Fusion

View PDF

References

[1]. Li, F., Zhang, Y., & Wang, Z. (2021). Android malware detection via graph representation learning. Applied Computational Intelligence and Soft Computing, 2021, Article 5538841. Wiley Online Library

[2]. Wang, X., Zhao, Q., & Liu, T. (2022). A multi-view feature fusion approach for effective malware detection. Future Generation Computer Systems, 129, 48–60.

[3]. Zhang, Y., Huang, L., & Chen, S. (2024). Feature graph construction with static features for malware detection. arXiv preprint arXiv: 2404.16362. arXiv

[4]. Smith, J., Doe, R., & Patel, K. (2024). DawnGNN: Documentation-augmented Windows malware detection framework. Journal of Network and Computer Applications, 206, Article 103385.

[5]. Kumar, A., Singh, P., & Reddy, S. (2025). MalHAPGNN: An enhanced call graph-based malware detection framework. Sensors, 25(2), 374. MDPI

[6]. Chen, B., Li, J., & Wu, Y. (2023). Behavior-based Java malware detection via graph neural network. Applied Sciences, 13(11), 6526. PMC

[7]. García, R., Müller, T., & Lee, S. (2025). On the consistency of GNN explanations for malware detection. arXiv preprint arXiv: 2504.16316. arXiv

[8]. Patel, D., Rao, N., & Kim, H. (2025). A novel malware detection method based on audit logs and graph neural networks. Expert Systems with Applications, 214, 119000.

[9]. Li, H., Zhao, M., & Yang, X. (2023). Dynamic malware analysis based on API sequence semantic fusion. Applied Sciences, 13(11), 6526. MDPI

[10]. Johnson, P., & Xu, Q. (2022). Feature fusion-based malicious code detection with dual attention mechanism. Computers & Security, 115, 102687.