Learning Joint Embeddings of Function and Process Call Graphs for Malware Detection

AI summary

Overview

Research area: Graph machine learning applied to cybersecurity, specifically multimodal graph representation learning for malware detection, combining static and dynamic views of Windows executables.

Technical level: Intermediate. The paper assumes familiarity with graph neural networks, convolutional message passing, node feature engineering, and standard malware-analysis concepts such as static versus dynamic analysis.

Scope: The paper builds a paired dataset of function call graphs and process call graphs from 635 Windows executables and proposes GeminiNet, a dual-branch graph convolutional architecture with a learnable gating mechanism, to test whether joint embeddings outperform single-graph and merged-graph alternatives.

What This Paper Is About

Software can be represented as several different kinds of graphs, each revealing a different perspective: function call graphs (FCGs) capture which functions call which other functions inside a program, while process call graphs (PCGs) capture how processes are spawned and interact at runtime. Prior malware-detection work using graph neural networks has generally picked one representation and ignored the other, so the complementary information across views has gone largely unexplored. This paper asks whether learning a single joint embedding from both graph types simultaneously produces a more robust malware classifier than using either graph alone.

Key Contributions

1. A dataset construction pipeline that produces paired FCGs and PCGs from Windows Portable Executable files, using Ghidra for static function call extraction and the Any.Run sandbox for dynamic process behavior, yielding 635 graph pairs (318 malicious, 317 benign).
2. GeminiNet, a graph convolutional neural network with a joint embedding approach that fuses representations across FCGs and PCGs through two parallel, non-weight-sharing encoder branches.
3. An adaptive gating mechanism based on a trainable gate vector computed as a softmax over learnable weights, which adaptively balances the static and dynamic contributions rather than concatenating or averaging them.
4. Joint node features that combine a Local Degree Profile (local structural statistics) with file-level Shannon entropy (a global statistical property of the binary).

Main Findings

• Joint embeddings beat single graphs and merged graphs. Across five-fold cross-validation, the best GeminiNet configurations reach a mean F1 of 0.85 with standard deviations of 0.06 to 0.09 for SGC and GCN, and a maximum F1 of up to 0.94 for the best configuration.
• The merged-graph setting performs substantially worse. When the FCG and PCG edge lists are combined into one unified graph before learning, mean F1 scores cluster between 0.71 and 0.73, with the top entry at 0.73 (SGC, LDP+Entropy, 4 layers, 2 fully connected layers, dimension 64, OneCycleLR).
• Single FCG models are the weakest. The best mean F1 for a single function call graph is 0.72 (SGC with LDP+Entropy features, 5 layers, 2 fully connected layers, dimension 64, ReduceLROnPlateau).
• Single PCG models are stronger than single FCG models. PCG-based models achieve mean F1 scores above 0.80, with the best at 0.83 using GIN with LDP+Entropy (5 layers, 2 fully connected layers, dimension 64, OneCycleLR).
• The design choices matter more than the architecture. Across the top configurations, the combination of LDP+Entropy features and weighted-sum joint embeddings appeared universally, suggesting these choices contribute more to performance than the specific GNN family: SGC, GCN, GraphSAGE, and GIN all performed well, and the strongest configurations achieved a mean in the range of 0.84 to 0.85.
• Statistical testing confirms the configuration ranking. Using the top 100 validation scores per group, a Kruskal-Wallis test found highly significant differences across the four configurations (p = 3.86e-76), and post-hoc Dunn tests confirmed all pairwise comparisons remained significant after Bonferroni correction. Pairwise p-values include 2.15e-34 between both_merged and both_wsum, 2.04e-67 between both_wsum and single_fcg, 3.23e-07 between both_wsum and single_pcg, and 1.83e-32 between single_fcg and single_pcg.
• Median performance ordering. The both_wsum configuration achieved the highest and most consistent performance (median F1 approximately 0.87), followed by single_pcg (median approximately 0.82), while both_merged (median approximately 0.72) and single_fcg (median approximately 0.67) performed significantly worse.
• Feature fusion helps. Comparing feature configurations on the top 100 validation F1 scores per group produced a Kruskal-Wallis result of p approximately 2.57e-33, with post-hoc Dunn tests confirming significance in all pairwise comparisons. The LDP+entropy group reached the highest and most consistent F1 scores (median approximately 0.85), followed by LDP (median approximately 0.82), while entropy alone yielded the weakest results (median approximately 0.77).
• Node feature construction. LDP gives each node five features (its own degree plus the minimum, maximum, mean, and standard deviation of its neighbors' degrees); Shannon entropy adds one file-level feature assigned uniformly to every node; LDP+Entropy therefore gives six features per node.
• Graph sizes. Across all 635 executables, FCGs contained 449,960 nodes and 1,048,741 edges, while PCGs contained only 3,053 nodes and 2,663 edges. The combined dataset totals 453,013 nodes and 1,051,404 edges.

Methodology in Plain English

The researchers started by assembling 635 Windows Portable Executable files: 318 malicious and 317 benign. For each file they built two graphs. The static graph, the FCG, came from decompiling the executable with Ghidra; nodes are functions and directed edges are calls from one function to another, with function names and call targets replaced by numeric identifiers. The dynamic graph, the PCG, came from running each executable inside the Any.Run malware sandbox for 60 seconds; nodes are spawned processes and directed edges represent process creation or communication. The 60-second window was chosen with reference to prior work by Küchler et al., which observed that most samples execute for under two minutes and that this achieves 98% code coverage.

Each node then received features. The Local Degree Profile describes local topology by recording a node's own degree and the minimum, maximum, mean, and standard deviation of its neighbors' degrees. Shannon entropy, computed directly from the raw bytes of the file using H(X) = -sum p_i log2 p_i, captures how random the binary is, and because it describes the file as a whole, the same value is assigned to every node in the graph. The two can also be concatenated.

GeminiNet itself has two parallel GCN branches, one for the FCG and one for the PCG, with a global pooling operator turning each branch's node embeddings into a graph-level vector. Instead of concatenating or averaging those two vectors, the model learns a gate vector via softmax over learnable weights, giving weights that are non-negative and sum to one, and forms the final joint embedding as their weighted combination. That embedding passes through fully connected layers with ReLU activation and dropout, and a softmax produces the malware-versus-benign probability. Turning off one branch reduces the model to the single-graph case and bypasses the gate.

Experiments used five-fold cross-validation with fixed folds, running the same controlled ablation across GIN, GraphSAGE, SGC, GCN, and an MLP baseline, all adapted to consume both graph types. Four configurations were compared: FCG only, PCG only, a merged graph with the two edge lists combined into one graph, and the dual-branch weighted-sum fusion.

Why This Matters

Impact on research. The paper reframes software representation as a multimodal graph learning problem rather than a single-graph one, and provides an ablation demonstrating that how you combine graphs (learned weighted sum versus naive edge merging) matters as much as which GNN you use. The paired FCG/PCG dataset of 635 executables with 453,013 nodes and 1,051,404 edges is itself a reusable artifact for static-versus-dynamic comparisons.

Real-world applications.

• Endpoint and antivirus detection, where combining static structure with runtime process behavior could reduce reliance on any single, adversarially fragile signal.
• Sandbox triage pipelines, where the dynamic PCG branch is comparatively cheap to build (3,053 nodes and 2,663 edges across the whole dataset versus 449,960 nodes and 1,048,741 edges for FCGs) and yet carries strong predictive signal on its own.
• Software supply-chain and binary vetting, since the authors note the approach generalizes to software vulnerability analysis and binary similarity detection.
• Threat-intelligence enrichment, where per-sample gating weights indicate whether a given binary's static or dynamic view is the more informative one for an analyst.

Industry relevance. Security vendors already deploy both reverse-engineering tooling (Ghidra) and sandboxing (Any.Run), so the inputs GeminiNet needs are within existing operational workflows. The finding that process call graphs alone reach a mean F1 above 0.80 while function call graphs top out at 0.72 suggests where teams with limited analysis budget might concentrate effort.

Future Directions

• Scaling the approach to larger datasets, which the authors explicitly name as future work.
• Investigating explainability techniques so that gating decisions and graph contributions can be interpreted by analysts.
• Extending beyond malware detection to the other tasks the authors mention as generalizable targets, namely software vulnerability analysis and binary similarity detection.
• Examining how much the joint embedding helps under adversarial conditions, given the paper's claim that relying on a single modality risks adversarial fragility but does not report adversarial experiments.

Target Audience

Researchers and graduate students in graph machine learning, program analysis, and security who are interested in multimodal representation learning over software artifacts. It is also useful for malware analysts and security engineers who want an empirically grounded sense of how static and dynamic graph signals compare in strength, and for practitioners seeking a template for building paired graph datasets from reverse-engineering and sandboxing tools.

Note: the paper does not report precision, recall, accuracy, inference latency, or a direct comparison against non-graph production malware classifiers; the abstract reports F1 statistics only.

Authors’ abstract

Software systems can be represented as graphs, capturing dependencies among functions and processes. An interesting aspect of software systems is that they can be represented as different types of graphs, depending on the extraction goals and priorities. For example, function calls within the software can be captured to create function call graphs, which highlight the relationships between functions and their dependencies. Alternatively, the processes spawned by the software can be modeled to generate process interaction graphs, which focus on runtime behavior and inter-process communication. While these graph representations are related, each captures a distinct perspective of the system, providing complementary insights into its structure and operation. While previous studies have leveraged graph neural networks (GNNs) to analyze software behaviors, most of this work has focused on a single type of graph representation. The joint modeling of both function call graphs and process interaction graphs remains largely underexplored, leaving opportunities for deeper, multi-perspective analysis of software systems. This paper presents a pipeline for constructing and training Function Call Graphs (FCGs) and Process Call Graphs (PCGs) and learning joint embeddings. We demonstrate that joint embeddings outperform a single-graph model. In this paper, we propose GeminiNet, a unified neural network approach that learns joint embeddings from both FCGs and PCGs. We construct a new dataset of 635 Windows executables (318 malicious and 317 benign), extracting FCGs via Ghidra and PCGs via Any.Run sandbox. GeminiNet employs dual graph convolutional branches with an adaptive gating mechanism that balances contributions from static and dynamic views.