AMD-FCG: An Enhanced Function Call Graph Dataset with Integrated Topological Features for Malware Detection and Classification

D.K. Bhattacharyya; J.K. Kalita; Parthajit Borah; Sakshi Singh

REVIEW 2 major objections 2 minor 25 references

AMD-FCG: An Enhanced Function Call Graph Dataset with Integrated Topological Features for Malware Detection and Classification

T0 review · 2 major / 2 minor · reviewed 2026-06-27 · grok-4.3

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read AMD-FCG supplies function call graphs augmented with topological features so malware detection can proceed from static analysis alone.

desk verdict AMD-FCG is a dataset release that adds topological features to malware FCGs but supplies no experiments or metrics to show those features help detection. read the letter →

arxiv 2606.06815 v1 pith:YTJFZHTS submitted 2026-06-05 cs.CR cs.LG

Parthajit Borah , Sakshi Singh , D.K. Bhattacharyya , J.K. Kalita This is my paper · ORCID

classification cs.CRcs.LG

keywords malwaredetectionfunctioncallgraphstopologicalfeaturesdatasetstaticanalysiscybersecurityclassificationbenignapplications

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper presents AMD-FCG, a dataset that pairs function call graphs from malware samples and benign applications with their topological features. The authors argue this pre-integrated resource removes the need to perform dynamic analysis or heavy preprocessing when building detection systems. A sympathetic reader would see value in a ready-to-use collection that spans multiple malware families, because it could let practitioners move directly to model training. The central promise is that the added topological information supplies enough structural distinction for accurate classification across those families.

What carries the argument

AMD-FCG dataset, which augments standard function call graphs with topological features to supply distinguishing structural information for malware families and benign samples.

What would settle it

A head-to-head test in which classifiers trained on plain function call graphs match or exceed the accuracy of those trained on AMD-FCG, or in which dynamic analysis is still required for high performance, would show the added features do not deliver the claimed advantage.

Watch

Extended reading notes

Core claim

AMD-FCG is an enhanced Function Call Graph dataset integrated with topological features of malwares. The framework enhances the detection procedure, streamlining the workflow for cybersecurity professionals and also eliminating the need for dynamic analysis and extensive processing, so it can be used to develop and deploy more efficient and innovative malware detection systems.

Load-bearing premise

The topological features added to the function call graphs supply enough distinguishing information to achieve accurate detection across diverse malware families and benign applications.

Editorial extensions

If this is right

Malware detection systems can be built and run using only static analysis of the provided graphs.
Cybersecurity professionals gain a streamlined workflow that skips dynamic execution and extensive preprocessing.
Detection remains accurate and robust when the dataset covers multiple malware families together with benign applications.
New detection systems can be developed and deployed directly from the pre-augmented data.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

Teams without access to sandbox infrastructure could still train competitive detectors from this single static resource.
The same augmentation pattern might transfer to other graph-based security tasks such as API-call analysis or network-flow classification.
Researchers could isolate the contribution of the topological layer by retraining the same models on the graphs without those features.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Desk Editor's Note

read the letter

The main thing here is a new public dataset of function call graphs from malware and benign samples, with centrality, clustering coefficients, and similar measures added on top. That is the concrete contribution.

They describe pulling together FCGs across families and integrating the extra topological data, which extends the line of graph-based static analysis work. If the collection is actually released with usable format and documentation, that part gives the community something concrete to build on.

The soft spot is the complete absence of validation. The abstract claims the dataset streamlines detection and removes the need for dynamic analysis, yet the paper reports no classification experiments, no accuracy or F1 numbers, no ablation of topological versus plain structural features, and no comparison against earlier FCG collections. The assumption that the added features supply enough distinguishing signal therefore sits untested.

This is for researchers in malware detection who work with graph representations and need additional labeled data. A reader looking for ready-made FCG resources might extract some value from the construction steps and feature list.

I would send it for peer review if the data is publicly available and the authors are prepared to add at least basic ML results and comparisons during revision. Without that, the write-up does not yet support the performance claims.

Referee Report

2 major / 2 minor

Summary. The manuscript introduces AMD-FCG, an enhanced dataset of function call graphs (FCGs) derived from malware and benign samples, augmented with topological features such as centrality measures and clustering coefficients. It claims that the dataset improves malware detection and classification workflows, streamlines analysis for cybersecurity professionals, and removes the requirement for dynamic analysis or extensive processing.

Significance. If the topological features were shown to provide measurable gains in classification accuracy and robustness, the dataset could serve as a useful static-analysis resource for the malware detection community by offering pre-computed structural descriptors at scale.

major comments (2)

[Abstract] Abstract: the assertions that the dataset 'enhances the detection procedure' and 'eliminates the need for dynamic analysis' are presented without any supporting empirical evidence; no accuracy, precision, recall, F1, or AUC figures, no ablation comparing topological versus plain FCG features, and no baseline comparisons against prior FCG datasets appear anywhere in the manuscript.
[Dataset construction and feature-extraction sections] Dataset construction and feature-extraction sections: the paper describes how FCGs are built and how topological features are extracted, yet supplies no machine-learning experiments, cross-family robustness tests, or statistical validation that these features actually improve separability between malware families and benign applications.

minor comments (2)

Clarify the exact set of topological features retained, their computation method (e.g., NetworkX or igraph routines), and any normalization steps applied before release.
Provide a public link or DOI for the released dataset together with a manifest that lists sample counts per family and per feature type.

Simulated Author's Rebuttal

2 responses · 0 unresolved

We thank the referee for the detailed and constructive report. We address each major comment below. The manuscript is a dataset paper focused on construction and release; we acknowledge that it contains no machine-learning experiments or performance metrics, and we will revise the text to remove or qualify unsupported claims.

read point-by-point responses

Referee: [Abstract] Abstract: the assertions that the dataset 'enhances the detection procedure' and 'eliminates the need for dynamic analysis' are presented without any supporting empirical evidence; no accuracy, precision, recall, F1, or AUC figures, no ablation comparing topological versus plain FCG features, and no baseline comparisons against prior FCG datasets appear anywhere in the manuscript.

Authors: We agree that these assertions lack supporting evidence in the manuscript. No experiments, metrics, or comparisons are present. The contribution is the AMD-FCG dataset with pre-computed topological features. In revision we will rewrite the abstract to describe the dataset's contents and intended use cases without claiming demonstrated improvements in detection accuracy or elimination of dynamic analysis. revision: yes
Referee: [Dataset construction and feature-extraction sections] Dataset construction and feature-extraction sections: the paper describes how FCGs are built and how topological features are extracted, yet supplies no machine-learning experiments, cross-family robustness tests, or statistical validation that these features actually improve separability between malware families and benign applications.

Authors: This assessment is accurate; the manuscript provides no ML experiments, robustness tests, or separability validation. As the work centers on dataset creation, we will revise these sections to state explicitly that no such empirical evaluations are included and to frame the topological features as resources made available for the community to investigate separability and classification performance. revision: yes

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity: dataset paper with no derivations or fitted predictions

full rationale

The manuscript introduces the AMD-FCG dataset by describing construction of function call graphs augmented with topological features (centrality, clustering coefficients, etc.). No equations, parameters, or predictive models are defined or fitted. The central claims concern dataset utility for malware classification and elimination of dynamic analysis, but these rest on untested assumptions rather than any derivation chain that reduces to its own inputs. No self-citations, ansatzes, or renamings of results appear in the provided text. This is a standard data-contribution paper whose validity is external (future ML benchmarks) and therefore scores 0.

Assumptions & free parameters 0 free parameters · 0 assumptions · 0 invented entities

No mathematical model, free parameters, axioms, or invented entities are described in the abstract.

how reviews work

0 comments

Cite this review

Pith. "Pith review of AMD-FCG: An Enhanced Function Call Graph Dataset with Integrated Topological Features for Malware Detection and Classification." pith.science (2026). https://pith.science/paper/YTJFZHTS

@misc{pith2026260606815,
  author       = {Pith},
  title        = {Pith review of: AMD-FCG: An Enhanced Function Call Graph Dataset with Integrated Topological Features for Malware Detection and Classification},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/YTJFZHTS}},
  note         = {Machine review of arXiv:2606.06815}
}

read the original abstract

As malware illustrates a complex structure and behavior, detection of these has been a significant challenge in the domain of cybersecurity along with related services in daily life. So, it becomes crucial to have a reliable and adaptive solution to address the issue. Among the several detection methods developed over the years, one of the most reliable ones is studying and analyzing the structural and behavioral patterns of malware. These patterns of sophisticated malware can be obtained with the help of Function Call Graphs (FCGs). However, to effectively cover numerous groups of families of malware, it is required to have a sufficiently large dataset for the system to operate on. In order to ensure accuracy and robustness of the system, the dataset should comprise samples of different malwares and a benign application for secure execution of the detection process. This paper introduces AMD-FCG, an enhanced Function Call Graph dataset integrated with topological features of malwares. The framework enhances the detection procedure, streamlining the workflow for cybersecurity professionals and also eliminating the need for dynamic analysis and extensive processing. Therefore, it can be used to develop and deploy more efficient and innovative malware detection systems.

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

25 extracted references · 1 canonical work pages

[1]

IEEE access8, 6249–6271 (2020) 18 AMD-FCG

Aslan, Ö.A., Samet, R.: A comprehensive review on malware detection approaches. IEEE access8, 6249–6271 (2020) 18 AMD-FCG

2020
[2]

Journal in computer virology 6, 105–114 (2010)

Kramer, S., Bradfield, J.C.: A general definition of malware. Journal in computer virology 6, 105–114 (2010)

2010
[3]

In: 2010 International Conference on Broadband, Wireless Computing, Communication and Applications, pp

You, I., Yim, K.: Malware obfuscation techniques: A brief survey. In: 2010 International Conference on Broadband, Wireless Computing, Communication and Applications, pp. 297–300 (2010). IEEE

2010
[4]

ACM Computing Surveys (CSUR) 52(5), 1–48 (2019)

Or-Meir, O., Nissim, N., Elovici, Y., Rokach, L.: Dynamic malware analy- sis in the modern era—a state of the art survey. ACM Computing Surveys (CSUR) 52(5), 1–48 (2019)

2019
[5]

ACM Computing Surveys (CSUR)50(3), 1–40 (2017)

Ye, Y., Li, T., Adjeroh, D., Iyengar, S.S.: A survey on malware detection using data mining techniques. ACM Computing Surveys (CSUR)50(3), 1–40 (2017)

2017
[6]

In: Twenty-third Annual Computer Security Applications Conference (ACSAC 2007), pp

Moser, A., Kruegel, C., Kirda, E.: Limits of static analysis for mal- ware detection. In: Twenty-third Annual Computer Security Applications Conference (ACSAC 2007), pp. 421–430 (2007). IEEE

2007
[7]

Computer Science Review32, 1–23 (2019)

Chakkaravarthy, S.S., Sangeetha, D., Vaidehi, V.: A survey on malware analysis and mitigation techniques. Computer Science Review32, 1–23 (2019)

2019
[8]

ACM computing surveys (CSUR) 44(2), 1–42 (2008)

Egele, M., Scholte, T., Kirda, E., Kruegel, C.: A survey on automated dynamic malware-analysis techniques and tools. ACM computing surveys (CSUR) 44(2), 1–42 (2008)

2008

Show all 25 references

[9]

Pattern Recognition Letters118, 14–22 (2019)

Yao, G., Lei, T., Zhong, J.: A review of convolutional-neural-network- based action recognition. Pattern Recognition Letters118, 14–22 (2019)

2019
[10]

arXiv preprint arXiv:2011.07682 (2020)

Freitas, S., Dong, Y., Neil, J., Chau, D.H.: A large-scale database for graph representation learning. arXiv preprint arXiv:2011.07682 (2020)

2011
[11]

In: International Conference on Detection of Intrusions and Malware, and Vulnerability Assessment (DIMVA’17), pp

Wei, F., Li, Y., Roy, S., Ou, X., Zhou, W.: Deep ground truth analysis of current android malware. In: International Conference on Detection of Intrusions and Malware, and Vulnerability Assessment (DIMVA’17), pp. 252–276. Springer, Bonn, Germany (2017)

2017
[12]

In: 2020 IEEE 4th Conference on Information & Communication Technology (CICT), pp

Borah, P., Bhattacharyya, D., Kalita, J.: Malware dataset genera- tion and evaluation. In: 2020 IEEE 4th Conference on Information & Communication Technology (CICT), pp. 1–6 (2020). IEEE

2020
[13]

IEEE Access 6, 51964–51974 (2018) AMD-FCG 19

Zhang, J., Qin, Z., Zhang, K., Yin, H., Zou, J.: Dalvik opcode graph based android malware variants detection using global topology features. IEEE Access 6, 51964–51974 (2018) AMD-FCG 19

2018
[14]

In: SoutheastCon 2016, pp

Fraley, J.B., Figueroa, M.: Polymorphic malware detection using topo- logical feature extraction with data mining. In: SoutheastCon 2016, pp. 1–7 (2016). IEEE

2016
[15]

IEEE Access6, 19007–19017 (2018)

Wu, P., Wang, J., Tian, B.: Software homology detection with software motifs based on function-call graph. IEEE Access6, 19007–19017 (2018)

2018
[16]

Monthly Notices of the Royal Astronomical Society 465(4), 4281–4310 (2017)

Pranav, P., Edelsbrunner, H., Van de Weygaert, R., Vegter, G., Kerber, M.,Jones,B.J.,Wintraecken,M.:Thetopologyofthecosmicwebinterms of persistent betti numbers. Monthly Notices of the Royal Astronomical Society 465(4), 4281–4310 (2017)

2017
[17]

Jonsson, J.: Simplicial Complexes of Graphs vol. 1928. Springer, Berlin, Heidelberg (2008)

1928
[18]

CRC press, Boca Raton (2018)

Munkres, J.R.: Elements of Algebraic Topology. CRC press, Boca Raton (2018)

2018
[19]

Bulletin of the American Mathematical Society 46(2), 255–308 (2009)

Carlsson, G.: Topology and data. Bulletin of the American Mathematical Society 46(2), 255–308 (2009)

2009
[20]

Stillwell, J.: Classical Topology and Combinatorial Group Theory vol. 72. Springer, New York, NY (2012)

2012
[21]

In: Proceedings of ECCS 2014: European Conference on Complex Systems, pp

Rucco, M., Castiglione, F., Merelli, E., Pettini, M.: Characterisation of the idiotypic immune network through persistent entropy. In: Proceedings of ECCS 2014: European Conference on Complex Systems, pp. 117–128 (2016). Springer

2014
[22]

Matsumoto, Y.: An Introduction to Morse Theory vol. 208. American Mathematical Soc., Providence, RI (2002)

2002
[23]

Milnor, J.W.: Morse Theory vol. 51. Princeton university press, Prince- ton, NJ (1963)

1963
[24]

In: Proceedings of the Twentieth Annual Symposium on Computational Geometry, pp

Zomorodian, A., Carlsson, G.: Computing persistent homology. In: Proceedings of the Twentieth Annual Symposium on Computational Geometry, pp. 347–356 (2004)

2004
[25]

Journal of Machine Learning Research19(12), 1–39 (2018)

Carriere, M., Michel, B., Oudot, S.: Statistical analysis and parameter selection for mapper. Journal of Machine Learning Research19(12), 1–39 (2018)

2018

Pith tools

Reviewed June 27, 2026 · model on record in the stance chip above.

[1] [1]

IEEE access8, 6249–6271 (2020) 18 AMD-FCG

Aslan, Ö.A., Samet, R.: A comprehensive review on malware detection approaches. IEEE access8, 6249–6271 (2020) 18 AMD-FCG

2020

[2] [2]

Journal in computer virology 6, 105–114 (2010)

Kramer, S., Bradfield, J.C.: A general definition of malware. Journal in computer virology 6, 105–114 (2010)

2010

[3] [3]

In: 2010 International Conference on Broadband, Wireless Computing, Communication and Applications, pp

You, I., Yim, K.: Malware obfuscation techniques: A brief survey. In: 2010 International Conference on Broadband, Wireless Computing, Communication and Applications, pp. 297–300 (2010). IEEE

2010

[4] [4]

ACM Computing Surveys (CSUR) 52(5), 1–48 (2019)

Or-Meir, O., Nissim, N., Elovici, Y., Rokach, L.: Dynamic malware analy- sis in the modern era—a state of the art survey. ACM Computing Surveys (CSUR) 52(5), 1–48 (2019)

2019

[5] [5]

ACM Computing Surveys (CSUR)50(3), 1–40 (2017)

Ye, Y., Li, T., Adjeroh, D., Iyengar, S.S.: A survey on malware detection using data mining techniques. ACM Computing Surveys (CSUR)50(3), 1–40 (2017)

2017

[6] [6]

In: Twenty-third Annual Computer Security Applications Conference (ACSAC 2007), pp

Moser, A., Kruegel, C., Kirda, E.: Limits of static analysis for mal- ware detection. In: Twenty-third Annual Computer Security Applications Conference (ACSAC 2007), pp. 421–430 (2007). IEEE

2007

[7] [7]

Computer Science Review32, 1–23 (2019)

Chakkaravarthy, S.S., Sangeetha, D., Vaidehi, V.: A survey on malware analysis and mitigation techniques. Computer Science Review32, 1–23 (2019)

2019

[8] [8]

ACM computing surveys (CSUR) 44(2), 1–42 (2008)

Egele, M., Scholte, T., Kirda, E., Kruegel, C.: A survey on automated dynamic malware-analysis techniques and tools. ACM computing surveys (CSUR) 44(2), 1–42 (2008)

2008