Pith. sign in

REVIEW 5 major objections 6 minor 1 cited by

Explainable Malware Detection through Integrated Graph Reduction and Learning Techniques

T0 review · 5 major / 6 minor · reviewed 2026-08-11 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Leaf Prune, a one-pass removal of degree-1 nodes, shrinks malware graphs and lifts detection F1 from 0.965 to 0.971.

desk verdict A simple pruning heuristic that probably works, but the paper oversells its novelty and the main comparison table is skewed by averaging over destructive hyperparameter settings. read the letter →

arxiv 2412.03634 v1 pith:BIU4CP46 submitted 2024-12-04 cs.CR cs.LG

Hesamodin Mohammadian , Griffin Higgins , Samuel Ansong , Roozbeh Razavi-Far , Ali A. Ghorbani This is my paper · ORCID
classification cs.CRcs.LG
keywords malwaredetectioncontrolflowgraphfunctioncallreductionleafpruningneuralnetworkGNNExplainerexplainability
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper tries to show that a deliberately simple graph-reduction step, called Leaf Prune, makes graph-based malware detection both faster and more accurate. Leaf Prune removes every node with degree at most one in a single pass before a graph convolutional network classifies the binary. Compared with no pruning, Comp Prune, K-core, and walk-index sparsification, Leaf Prune gives the best average F1-score (0.971 versus 0.965 without pruning) while cutting huge function-call graphs down to a few million nodes. The paper also attaches GNNExplainer as a post-hoc step and reports that explanations built from the pruned graphs keep most of the classification signal. The stated payoff is a detection pipeline that balances efficiency and transparency.

What carries the argument

The load-bearing object is Leaf Prune, a one-step graph reduction defined by $L = \{v \in V \mid d(v) \le 1\}$ and the pruned graph $G' = (V \setminus L, E')$. It is not an iterative peeling: all degree-1 and isolated nodes are identified and removed at once, together with their incident edges. This single rule does the work of shrinking graphs, lowering serialization and training costs, and slightly improving the GCN's classification by stripping peripheral nodes that contribute little structural information. The pipeline also rests on two embedding mechanisms—a pretrained sentence-transformer language model for function-name vectors on FCG nodes, and a 406-dimensional rule-based assembly encoding compressed to 64 dimensions by an autoencoder for CFG nodes—and on GNNExplainer, whose edge-mask optimization extracts the subgraph that most influences the model's prediction.

What would settle it

Run the same Leaf Prune pipeline on a corpus of packed or obfuscated binaries where static graph recovery is incomplete; if pruning removes the nodes that carry the malicious behavior, detection F1 should fall below the no-prune baseline. The same check applies to a larger, balanced test set rather than the 2,313 malicious versus 520 benign samples used here.

Watch

Extended reading notes

Core claim

The central claim is that the peripheral nodes of statically recovered CFG and FCG graphs—nodes with degree at most one—are mostly noise for a GCN-based malware detector, and that one simultaneous pruning operation (Leaf Prune) removes them without losing detection power. In the experiments Leaf Prune reduced the FCG corpus from about 139 million nodes to about 3.18 million, and the CFG corpus from about 266 million to about 198 million nodes, while improving average F1 from 0.965±0.007 (no prune) to 0.971±0.002. It outperformed all compared reduction methods on accuracy, F1, precision, and recall, and did so with the least parameter-tuning cost because it has no hyperparameter. When GNNExplainer was applied to the pruned graphs, important subgraphs containing only a fraction of the edges still yielded high classification accuracy, especially for function-call graphs embedded through function names. The paper concludes that Leaf Prune should be the default graph-reduction step for malware detection.

Load-bearing premise

The result rests on the premise that statically recovered control-flow and function-call graphs capture enough of a binary's true behavior that removing their outermost nodes throws away noise rather than malicious logic.

Editorial extensions

If this is right

  • Inserting Leaf Prune before GCN training cuts the input graph size so sharply (FCG nodes drop from about 139 million to 3.18 million) that the pipeline needs less memory, time, and serialization cost.
  • Average detection F1 rises from 0.965 without pruning to 0.971 with Leaf Prune, and Leaf Prune has no tuning hyperparameter, unlike K-core or Comp Prune.
  • GNNExplainer on pruned function-call graphs keeps classification accuracy above 92 percent even when only 10 percent of edges are kept, so the explanations point to a small, decision-relevant subgraph.
  • For CFGs the reduction is smaller but still beneficial, meaning the technique transfers across graph representations rather than being tuned to one.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Because the F1 gain over no pruning is small, the practical value of Leaf Prune may be efficiency rather than accuracy; a fair comparison would report training and explanation wall-clock time per sample, which the paper only describes qualitatively.
  • The one-pass rule is equivalent to removing the outermost layer of the graph's k-core hierarchy; testing iterated peeling (2-core) against one-pass Leaf Prune on the same data would show whether the extra removals help or hurt.
  • GNNExplainer's better accuracy on FCG with function-name embeddings than on CFG with assembly embeddings suggests that smaller, function-level graphs localize explanations more cleanly; this could be tested by applying a second explainer and measuring agreement.
  • A natural extension the paper does not test is using the explainer's important subgraph from a pruned graph to judge whether pruning discarded any behavior the model relied on, connecting the two modules more tightly.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

5 major / 6 minor

Summary. The paper presents a malware detection pipeline that combines static CFG/FCG extraction with two node-embedding schemes (FNE and AE), a graph-reduction preprocessing stage, a GCN classifier, and post-hoc GNNExplainer-based explanations. The central claim is that the proposed parameter-free Leaf Prune method—removing all degree-≤1 nodes in one pass—reduces graph size substantially while preserving or improving classification performance, and that it compares favorably with Comp Prune, K-core, and WIS. The paper also evaluates explainability accuracy for the reduced graphs and concludes that Leaf Prune is the most effective and efficient reduction technique.

Significance. If the claims are sustained, the paper makes a useful practical contribution: a simple, hyperparameter-free graph reduction heuristic for static malware graphs, together with an integrated evaluation of embeddings, reduction methods, and explainability on a non-trivial corpus of PE binaries. The strengths include the use of two distinct graph types and embeddings, a head-to-head comparison of several reduction techniques, and an explicit explainability evaluation. However, the headline performance claim relies on a comparison protocol that averages over destructive hyperparameter configurations for the competing methods, and the experimental reporting lacks several details needed to assess statistical significance and reproducibility. The paper is therefore more convincing as a proof-of-concept for Leaf Prune's graph-size reduction than as a definitive demonstration of its classification superiority.

major comments (5)
  1. [§4.4, Table 1 and Figure 7] The claim that Leaf Prune is the best reduction technique is supported by averaging F1 over all hyperparameter settings for Comp Prune (u=0.5/0.7/0.9), K-core (k=1/2/3), and WIS (N=0.2/0.4), while Leaf Prune is evaluated only at its single parameter-free setting. As §4.3 shows, K-core k=3 and CP u=0.9 reduce graphs to almost zero nodes, which likely destroys label-relevant structure; including these settings in the average artificially lowers the competitors' mean F1. The paper itself notes in §4.4 that for AE, WIS N=0.2 and K-core K=1 achieve performance comparable to Leaf Prune. Please report per-configuration results (e.g., a table showing each reduction technique at each hyperparameter), perform paired significance tests on the same train/test folds, and state how each method's hyperparameter was selected (e.g., by validation performance) before claiming superiority.
  2. [§4.1, §4.4] The evaluation set is strongly imbalanced: 2313 malicious versus 520 benign samples. The paper does not specify whether F1 is macro-averaged, weighted, or computed on the positive class, and no class weighting, resampling, or balanced evaluation is reported. On a dataset with 82% malicious samples, accuracy and F1 can be high for a trivial majority-class classifier. Please specify the F1 definition and report per-class precision/recall, confusion matrices, or results under class-balanced evaluation to show that Leaf Prune's improvements are not driven by the majority class.
  3. [§3.5, §4.4] The experimental protocol is under-specified: no train/test split ratio, number of runs/seeds, cross-validation scheme, hyperparameter tuning procedure, or GCN training details (hidden dimension, learning rate, dropout, epochs, early stopping) are provided. Without this information, the observed differences such as 0.971±0.002 versus 0.965±0.007 cannot be assessed for statistical significance, and the experiments are not reproducible. Please add a complete experimental setup subsection and, if possible, release code and data to enable verification.
  4. [§4.5, Figure 10] The explainability evaluation uses only the accuracy of the model on the subgraph selected by GNNExplainer as the metric. Since the explainer is optimized to maximize the model's confidence on a subgraph, high accuracy on the selected subgraph is expected; a random-edge-mask baseline of the same size is needed to establish that the explanations are meaningful. Additionally, the comparison in Figure 10 mixes different reduction methods and embeddings without reporting statistical variability, so the claimed superiority of FNE-based explanations is not yet supported.
  5. [§1] The contribution statement says 'to the best of our knowledge, this is the first work to include graph pruning as a pre-processing step for the malware detection task.' This novelty claim is not adequately justified by the related-work discussion, which surveys graph reduction generally and cites CFG-based malware detection works; prior work on graph sparsification for malware graphs may exist. Please provide a more thorough literature comparison or soften the claim to reflect that the contribution is a systematic empirical comparison of existing and proposed reduction techniques in this specific pipeline.
minor comments (6)
  1. [§4.3] The text states that Leaf Prune is 'fast and efficient,' but no runtime, memory, or throughput measurements are reported anywhere in the paper. Efficiency is a claimed contribution, so please add wall-clock time and peak memory for each reduction and classification stage.
  2. [Figure 4 caption] The caption says 'NP and LP stand for Leaf Prune and No Prune,' but NP is No Prune and LP is Leaf Prune; the wording is reversed.
  3. [§3.3.1] The description of MiniLM says it maps sentences to a 348-dimensional space and then states the output is 384-dimensional; these numbers are inconsistent and should be reconciled.
  4. [Equation (3)] The k-core definition writes Gk = {v in V | d_Gk(v) >= k}, which is circular because Gk appears on both sides; use the standard iterative definition or explicitly define a subgraph H satisfying the degree condition.
  5. [§4.3, Figure 5] The y-axis label 'Number of (10^6)' is ambiguous because some bars are labeled with values that appear to be raw counts (e.g., 3.18, 75.90); please clarify units and axis notation.
  6. [Throughout] There are typographical and notation inconsistencies, such as 'U' versus 'u' for Comp Prune's parameter and 'diffrent' in §4.5; these should be corrected in a careful proofread.

Circularity Check

1 steps flagged · score 6.0 of 10

GNNExplainer 'explainer accuracy' is forced by the explainer's own training objective; the Leaf Prune classification result is independent.

  1. fitted input called prediction [Section 3.6, Eq. (7); Section 4.5 'Explainability-based Analysis']
    "The conditional entropy can be replaced with a cross-entropy loss between the true class label and the model prediction ... min M − P c 1[y = c] log PΦ(Y = y|G = Ac ⊙ σ(M ), X). Explainer accuracy is calculated using the important subgraph determined by the explainer as the model input and measuring the model detection ability."

    Equation (7) fits the edge mask M by minimizing cross-entropy between the true label y and the model's masked-graph prediction; the 'important subgraph' is therefore selected to reproduce the true label. Section 4.5 then measures the model's accuracy on that same selected subgraph and presents it as explainer quality. This is evaluating the explainer on its own training objective: the high accuracy on the top-p subgraph is forced by construction, not an independent confirmation that the explanation subgraph is meaningful. The claim that a small subgraph preserves detection performance reduces to the objective used to build the subgraph.

full rationale

The main graph-reduction comparison is an honest empirical measurement: Table 1 and Figures 6-8 report held-out GCN accuracy/F1 for each reduction technique, and Leaf Prune is a hyperparameter-free rule (remove nodes with degree <= 1). Its classification improvement over No Prune is not derived from the reduction definition, and no fitted parameter is renamed as a prediction. The concern that Table 1 averages competitors over destructive hyperparameter settings (e.g., K-core K=3, CP U=0.9) is an experimental-fairness issue, not circular reasoning. The circular element is confined to the explainability module: Eq. (7) trains the edge mask using the true label, and Section 4.5 reports model accuracy on the masked subgraph as evidence of explanation quality, so that accuracy is the training objective itself. Because this self-confirming result supports the paper's transparency claims, the overall score is 6 (partial circularity), while the central reduction/classification claim retains independent content.

Assumptions & free parameters 5 free parameters · 4 assumptions · 0 invented entities

The central claim rests on the empirical evaluation of graph reduction methods. The free parameters are standard hyperparameters searched over a small grid; they are not fitted to the test set in a circular manner. The key unstated assumptions are the reliability of static graph recovery and the representativeness of the imbalanced dataset. No new physical or conceptual entities are introduced.

free parameters (5)
  • Leaf degree threshold = d(v) ≤ 1
    The proposed method removes nodes with degree less than or equal to one; this threshold is chosen by the authors, not derived from data.
  • Comp Prune removal fraction u = 0.5, 0.7, 0.9
    Hyperparameter that controls the percentage of smallest connected components removed; tuned by exhaustive search.
  • K-core parameter k = 1, 2, 3
    Hyperparameter that sets the minimum degree of nodes in the remaining subgraph; tuned by exhaustive search.
  • WIS edge removal fraction N = 0.2, 0.4
    Hyperparameter that controls the fraction of edges removed by Walk Index Sparsification; tuned by exhaustive search.
  • Autoencoder embedding dimension = 64
    The assembly embedding uses an autoencoder to reduce features to 64 dimensions, following the approach in MalGNE [48]. This is a design choice from prior work, not fitted in this paper.
assumptions (4)
  • domain assumption Static analysis with angr faithfully recovers CFGs and FCGs from binary files.
    The entire pipeline depends on the correctness and completeness of angr's static recovery. Packed or obfuscated binaries may produce incomplete or misleading graphs.
  • domain assumption The selected datasets (BODMAS, Dike, PMML) are representative of real-world PE malware and benign samples.
    The paper samples only x86 PE files and does not discuss potential bias from dataset sources (e.g., PMML's prevalence of generic malware families).
  • domain assumption GNNExplainer identifies the subgraph that truly explains the model's prediction.
    The explainability analysis treats GNNExplainer's edge masks as ground-truth explanations; this is an assumption inherited from the explainability literature.
  • domain assumption A three-layer GCN with mean pooling is an appropriate and representative graph classifier for malware detection.
    The paper uses a simple GCN without comparison to other architectures, assuming it captures the relevant graph structure.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Explainable Malware Detection through Integrated Graph Reduction and Learning Techniques." pith.science (2026). https://pith.science/paper/BIU4CP46

@misc{pith2026241203634,
  author       = {Pith},
  title        = {Pith review of: Explainable Malware Detection through Integrated Graph Reduction and Learning Techniques},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/BIU4CP46}},
  note         = {Machine review of arXiv:2412.03634}
}
read the original abstract

Control Flow Graphs and Function Call Graphs have become pivotal in providing a detailed understanding of program execution and effectively characterizing the behavior of malware. These graph-based representations, when combined with Graph Neural Networks (GNN), have shown promise in developing high-performance malware detectors. However, challenges remain due to the large size of these graphs and the inherent opacity in the decision-making process of GNNs. This paper addresses these issues by developing several graph reduction techniques to reduce graph size and applying the state-of-the-art GNNExplainer to enhance the interpretability of GNN outputs. The analysis demonstrates that integrating our proposed graph reduction technique along with GNNExplainer in the malware detection framework significantly reduces graph size while preserving high performance, providing an effective balance between efficiency and transparency in malware detection.

Figures

Figures reproduced from arXiv: 2412.03634 by the authors.

Figure 1
Figure 1. Proposed framework for malware detection including two modules for data collection and graph generation, two [PITH_FULL_IMAGE:figures/full_fig_p004_1.png] view at source ↗
Figure 2
Figure 2. Schematic diagram of assembly instruction embedding. [PITH_FULL_IMAGE:figures/full_fig_p005_2.png] view at source ↗
Figure 3
Figure 3. Graph classification model architecture. [PITH_FULL_IMAGE:figures/full_fig_p008_3.png] view at source ↗
Figures from the paper (7 more)
Figure 4
Figure 4. Figure 4: Visualization of example malicious and benign samples. Each panel shows a generated graph through an embedding [PITH_FULL_IMAGE:figures/full_fig_p010_4.png]
Figure 5
Figure 5. Figure 5: Comparing number of nodes, edges, and components of FCG (top panel) and CFG (bottom panel) generated through [PITH_FULL_IMAGE:figures/full_fig_p011_5.png]
Figure 6
Figure 6. Figure 6: Classification accuracy and F1-score obtained through each embedding technique along with each reduction technique [PITH_FULL_IMAGE:figures/full_fig_p012_6.png]
Figure 7
Figure 7. Figure 7: Average and standard deviation of F1-scores obtained through each graph reduction technique w.r.t. different hyper [PITH_FULL_IMAGE:figures/full_fig_p013_7.png]
Figure 8
Figure 8. Figure 8: Performance metrics obtained through different combinations of the node embeddings and reduction techniques. [PITH_FULL_IMAGE:figures/full_fig_p014_8.png]
Figure 9
Figure 9. Figure 9: Explainer output with p = 25% in panel (a) that includes the importance weights of all the edges. To generate the subgraphs, the top p percent of the edges are kept and the rest of the nodes and edges are removed. Since leaf prune and WIS were the best reduction techni…
Figure 10
Figure 10. Figure 10: The classification accuracy of important subgraphs. [PITH_FULL_IMAGE:figures/full_fig_p015_10.png]

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. Dual Explanations via Subgraph Matching for Malware Detection

    cs.CR 2025-04 reject novelty 5.0 of 10

    A dual explainer framework for GNN malware detectors that scores nodes by matching them to model-verified benign and malicious subgraphs using the VF2 algorithm.

Reference graph

Works this paper leans on

55 extracted references · 45 canonical work pages · cited by 1 Pith paper

  1. [26]

    Hashemi, S

    M. Hashemi, S. Gong, J. Ni, W. Fan, B. A. Prakash, W. Jin, A comprehensive survey on graph reduction: Sparsification, coarsening, and condensation, arXiv preprint arXiv:2402.03358v4 (2024)

    arXiv 2024

  2. [1]

    2024 identity security threat landscape report, https://www.cyberark.com/threat-landscape/

    work page 2024

  3. [2]

    Y. Li, K. Xiong, T. Chin, C. Hu, A machine learning framework for domain generation algorithm-based malware detection, IEEE Access 7 (2019) 32765–32782

    work page 2019

  4. [3]

    H.-D. Pham, T. D. Le, T. N. Vu, Static pe malware detection using gradient boosting decision trees algorithm, in: Future Data and Security Engineering: 5th International Conference, FDSE 2018, Ho Chi Minh City, Vietnam, November 28–30, 2018, Proceedings 5, Springer, 2018, pp. 228–236

    work page 2018

  5. [4]

    B. M. Khammas, Ransomware detection using random forest technique, ICT Express 6 (4) (2020) 325–331

    2020

  6. [5]

    Zhang, Z

    J. Zhang, Z. Qin, H. Yin, L. Ou, S. Xiao, Y. Hu, Malware variant detection using opcode image recognition with small training sets, in: 2016 25th International Conference on Computer Communication and Networks (ICCCN), IEEE, 2016, pp. 1–9

    work page 2016

  7. [6]

    Manavi, A

    F. Manavi, A. Hamzeh, A new method for ransomware detection based on pe header using convolutional neural networks, in: 2020 17th international ISC conference on information security and cryptology (ISCISC), IEEE, 2020, pp. 82–87. 15

    work page 2020

  8. [7]

    Frederick, J

    R. Frederick, J. Shapiro, R. A. Calix, A corpus of encoded malware byte information as images for efficient classification, in: 2022 16th International Conference on Signal-Image Technology & Internet-Based Systems (SITIS), IEEE, 2022, pp. 32–36

    work page 2022

Show all 55 references
  1. [8]

    C. Li, Q. Lv, N. Li, Y. Wang, D. Sun, Y. Qiao, A novel deep framework for dynamic malware detection based on api sequence intrinsic features, Computers & Security 116 (2022) 102686

    2022

  2. [9]

    Bensaoud, J

    A. Bensaoud, J. Kalita, Cnn-lstm and transfer learning models for malware classification based on opcodes and api calls, Knowledge-Based Systems (2024) 111543

    2024

  3. [10]

    E. M. Dovom, A. Azmoodeh, A. Dehghantanha, D. E. Newton, R. M. Parizi, H. Karimipour, Fuzzy pattern tree for edge malware detection and categorization in iot, Journal of Systems Architecture 97 (2019) 1–7

    2019

  4. [11]

    X. Liu, X. Du, Q. Lei, K. Liu, Multifamily classification of android malware with a fuzzy strategy to resist polymorphic familial variants, IEEE Access 8 (2020) 156900–156914

    2020

  5. [12]

    Y. Sun, A. K. Bashir, U. Tariq, F. Xiao, Effective malware detection scheme based on classified behavior graph in iiot, Ad Hoc Networks 120 (2021) 102558

    2021

  6. [13]

    Abusnaina, M

    A. Abusnaina, M. Abuhamad, H. Alasmary, A. Anwar, R. Jang, S. Salem, D. Nyang, D. Mohaisen, Dl-fhmc: Deep learning- based fine-grained hierarchical learning approach for robust malware classification, IEEE Transactions on Dependable and Secure Computing 19 (5) (2021) 3432–3447

    2021

  7. [14]

    Zhang, X

    Y. Zhang, X. Chang, Y. Lin, J. Miˇ si´ c, V. B. Miˇ si´ c, Exploring function call graph vectorization and file statistical features in malicious pe file classification, IEEE Access 8 (2020) 44652–44660

    2020

  8. [15]

    M. Cai, Y. Jiang, C. Gao, H. Li, W. Yuan, Learning features from enhanced function call graphs for android malware detection, Neurocomputing 423 (2021) 301–307

    2021

  9. [16]

    C.-Y. Wu, T. Ban, S.-M. Cheng, T. Takahashi, D. Inoue, Iot malware classification based on reinterpreted function-call graphs, Computers & Security 125 (2023) 103060

    2023

  10. [17]

    E. Amer, I. Zelinka, A dynamic windows malware detection and prediction method based on contextual understanding of api call sequence, Computers & Security 92 (2020) 101760

    2020

  11. [18]

    E. Amer, I. Zelinka, S. El-Sappagh, A multi-perspective malware detection approach through behavioral fusion of api call sequence, Computers & Security 110 (2021) 102449

    2021

  12. [19]

    C. Li, Z. Cheng, H. Zhu, L. Wang, Q. Lv, Y. Wang, N. Li, D. Sun, Dmalnet: Dynamic malware analysis based on api feature engineering and graph learning, Computers & Security 122 (2022) 102872

    2022

  13. [20]

    Y. Gao, H. Hasegawa, Y. Yamaguchi, H. Shimada, Malware detection by control-flow graph level representation learning with graph isomorphism network, IEEE Access 10 (2022) 111830–111841

    2022

  14. [21]

    M. H. Nguyen, D. Le Nguyen, X. M. Nguyen, T. T. Quan, Auto-detection of sophisticated malware using lazy-binding control flow graph and deep learning, Computers & Security 76 (2018) 128–155

    2018

  15. [22]

    J. D. Herath, P. P. Wakodikar, P. Yang, G. Yan, Cfgexplainer: Explaining graph neural network-based malware classifi- cation from control flow graphs, in: 2022 52nd Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN), IEEE, 2022, pp. 172–184

    2022

  16. [23]

    H. Gao, S. Cheng, W. Zhang, Gdroid: Android malware detection and classification with graph convolutional network, Computers & Security 106 (2021) 102264

    2021

  17. [24]

    Bruna, W

    J. Bruna, W. Zaremba, A. Szlam, Y. LeCun, Spectral networks and locally connected networks on graphs, arXiv preprint arXiv:1312.6203 (2013)

    2013 arXiv

  18. [25]

    T. N. Kipf, M. Welling, Semi-supervised classification with graph convolutional networks, arXiv preprint arXiv:1609.02907 (2016)

    2016 arXiv

  19. [27]

    P. Hu, W. C. Lau, A survey and taxonomy of graph sampling, arXiv preprint arXiv:1308.5865 (2013)

    2013 arXiv

  20. [28]

    X. Li, K. Wang, H. Deng, Y. Liang, D. Wu, Attend who is weak: Enhancing graph condensation via cross-free adversarial training, arXiv preprint arXiv:2311.15772 (2023)

    2023 arXiv

  21. [29]

    Razin, T

    N. Razin, T. Verbin, N. Cohen, On the ability of graph neural networks to model interactions between vertices (2023). arXiv:2211.16494. URL https://arxiv.org/abs/2211.16494

    2023 arXiv

  22. [30]

    Warmsley, A

    D. Warmsley, A. Waagen, J. Xu, Z. Liu, H. Tong, A survey of explainable graph neural networks for cyber malware analysis, in: 2022 IEEE International Conference on Big Data (Big Data), IEEE, 2022, pp. 2932–2939

    2022

  23. [31]

    D. Arp, M. Spreitzenbarth, M. Hubner, H. Gascon, K. Rieck, C. Siemens, Drebin: Effective and explainable detection of android malware in your pocket., in: Ndss, Vol. 14, 2014, pp. 23–26

    2014

  24. [32]

    Kinkead, S

    M. Kinkead, S. Millar, N. McLaughlin, P. O’Kane, Towards explainable cnns for android malware detection, Procedia Computer Science 184 (2021) 959–965

    2021

  25. [33]

    Ullah, A

    F. Ullah, A. Alsirhani, M. M. Alshahrani, A. Alomari, H. Naeem, S. A. Shah, Explainable malware detection system using transformers-based transfer learning and multi-model visual representation, Sensors 22 (18) (2022) 6766

    2022

  26. [34]

    M. M. Alani, A. Mashatan, A. Miri, Xmal: A lightweight memory-based explainable obfuscated-malware detector, Com- puters & Security 133 (2023) 103409

    2023

  27. [35]

    Z. Ying, D. Bourgeois, J. You, M. Zitnik, J. Leskovec, Gnnexplainer: Generating explanations for graph neural networks, Advances in neural information processing systems 32 (2019)

    2019

  28. [36]

    D. Luo, W. Cheng, D. Xu, W. Yu, B. Zong, H. Chen, X. Zhang, Parameterized explainer for graph neural network, Advances in neural information processing systems 33 (2020) 19620–19631

    2020

  29. [37]

    H. Yuan, H. Yu, J. Wang, K. Li, S. Ji, On explainability of graph neural networks via subgraph explorations, in: Interna- tional conference on machine learning, PMLR, 2021, pp. 12241–12252. 16

    2021

  30. [38]

    Domingos, A few useful things to know about machine learning, Communications of the ACM 55 (10) (2012) 78–87

    P. Domingos, A few useful things to know about machine learning, Communications of the ACM 55 (10) (2012) 78–87

    2012

  31. [39]

    Halevy, P

    A. Halevy, P. Norvig, F. Pereira, The unreasonable effectiveness of data, IEEE intelligent systems 24 (2) (2009) 8–12

    2009

  32. [40]

    R. S. Geiger, K. Yu, Y. Yang, M. Dai, J. Qiu, R. Tang, J. Huang, Garbage in, garbage out? do machine learning application papers in social computing report where human-labeled training data comes from?, in: Proceedings of the 2020 conference on fairness, accountability, and tr...

    2020

  33. [41]

    Roberts, Virus share (2011)

    J.-M. Roberts, Virus share (2011)

    2011

  34. [42]

    Quist, Open malware (2009)

    D. Quist, Open malware (2009)

    2009

  35. [43]

    Baecher, M

    P. Baecher, M. Koetter, T. Holz, M. Dornseif, F. Freiling, The nepenthes platform: An efficient approach to collect malware, in: Recent Advances in Intrusion Detection: 9th International Symposium, RAID 2006 Hamburg, Germany, September 20-22, 2006 Proceedings 9, Springer, 2006...

    2006

  36. [44]

    Shoshitaishvili, R

    Y. Shoshitaishvili, R. Wang, C. Salls, N. Stephens, M. Polino, A. Dutcher, J. Grosen, S. Feng, C. Hauser, C. Kruegel, G. Vigna, Sok: (state of) the art of war: Offensive techniques in binary analysis (2016)

    2016

  37. [45]

    Stephens, J

    N. Stephens, J. Grosen, C. Salls, A. Dutcher, R. Wang, J. Corbetta, Y. Shoshitaishvili, C. Kruegel, G. Vigna, Driller: Augmenting fuzzing through selective symbolic execution (2016)

    2016

  38. [46]

    Shoshitaishvili, R

    Y. Shoshitaishvili, R. Wang, C. Hauser, C. Kruegel, G. Vigna, Firmalice - automatic detection of authentication bypass vulnerabilities in binary firmware (2015)

    2015

  39. [47]

    W. Wang, F. Wei, L. Dong, H. Bao, N. Yang, M. Zhou, Minilm: Deep self-attention distillation for task-agnostic com- pression of pre-trained transformers, Advances in Neural Information Processing Systems 33 (2020) 5776–5788

    2020

  40. [48]

    H. Peng, J. Yang, D. Zhao, X. Xu, Y. Pu, J. Han, X. Yang, M. Zhong, S. Ji, Malgne: Enhancing the performance and efficiency of cfg-based malware detector by graph node embedding in low dimension space, IEEE Transactions on Information Forensics and Security (2024)

    2024

  41. [49]

    Razin, T

    N. Razin, T. Verbin, N. Cohen, On the ability of graph neural networks to model interactions between vertices, Advances in Neural Information Processing Systems 36 (2023) 26501–26545

    2023

  42. [50]

    Paszke, S

    A. Paszke, S. Gross, S. Chintala, G. Chanan, E. Yang, Z. DeVito, Z. Lin, A. Desmaison, L. Antiga, A. Lerer, Automatic differentiation in pytorch (2017)

    2017

  43. [51]

    M. Fey, J. E. Lenssen, Fast graph representation learning with pytorch geometric, CoRR abs/1903.02428 (2019). arXiv: 1903.02428. URL http://arxiv.org/abs/1903.02428

    2019 arXiv

  44. [52]

    A. A. Hagberg, D. A. Schult, P. J. Swart, Exploring network structure, dynamics, and function using networkx, in: G. Varoquaux, T. Vaught, J. Millman (Eds.), Proceedings of the 7th Python in Science Conference, Pasadena, CA USA, 2008, pp. 11 – 15. URL http://conference.scipy.o...

    2008

  45. [53]

    L. Yang, A. Ciptadi, I. Laziuk, A. Ahmadzadeh, G. Wang, Bodmas: An open dataset for learning based temporal analysis of pe malware, in: 2021 IEEE Security and Privacy Workshops (SPW), IEEE, 2021, pp. 78–84

    2021

  46. [54]

    Iosif, Dikedataset, https://github.com/iosifache/DikeDataset, accessed on February 27, 2024 (2021)

    G.-A. Iosif, Dikedataset, https://github.com/iosifache/DikeDataset, accessed on February 27, 2024 (2021)

    2021

  47. [55]

    Practical Security Analytics LLC, Pe malware machine learning dataset, https://practicalsecurityanalytics.com/ pe-malware-machine-learning-dataset/ , accessed: 2024-08-06 (2024). 17

    2024

Pith tools

Reviewed August 11, 2026 · model on record in the stance chip above.