FCGAT: Interpretable Malware Classification Method
using Function Call Graph and Attention Mechanism
Minami Someya∗† , Yuhei Otsubo†∗ and Akira Otsuka∗∗ Institute of information Security, Kanagawa, Japan† National Police Agency, Tokyo, Japan

Email: mgs227501@iisec.ac.jp
Abstract—Malware classification facilitates static analysis,
which is manually intensive but necessary work to understandthe inner workings of unknown malware. Machine learning based
approaches have been actively studied and have great potential.
However, their drawback is that their models are considered blackboxes and are challenging to explain their classification results
and thus cannot provide patterns specific to malware. To address
this problem, we propose FCGAT, the first malware classification
method that provides interpretable classification reasons based onprogram functions. FCGAT applies natural language processing
techniques to create function features and updates them toreflect the calling relationships between functions. Then, it applies
attention mechanism to create malware feature by emphasizing
the functions that are important for classification with attention
weights. FCGAT provides an importance ranking of functions
based on attention weights as an explanation. We evaluate theperformance of FCGAT on two datasets. The results show that
the F1-Scores are 98.15% and 98.18%, which are competitive
with the cutting-edge methods. Furthermore, we examine howmuch the functions emphasized by FCGAT contribute to theclassification. Surprisingly, our result show that only top 6(average per sample) highly-weighted functions yield as muchas 70% accuracy. We also show that these functions reflect
the characteristics of malware by analyzing them. FCGAT canprovide analysts with reliable explanations using a small numberof functions. These explanations could bring various benefits, suchas improved efficiency in malware analysis and comprehensive
malware trend analysis.

I.

I NTRODUCTION

Despite their great potential, their models lack interpretability
and have difficulty in explaining the reasons behind malware
classification. Thus, analysts often struggle to identify thecode that characterizes malware. Generally, there is a tradeoff between model interpretability and classification performance [3]. Complex models such as deep learning can improve
performance due to their high representation capacity. However, these models are treated as black boxes, and it is difficult to obtain explanations for their predictions. Nevertheless,the explanations for incorrect predictions cannot be trusted.
Therefore, it is necessary to achieve both high performanceand interpretability.
Attention mechanism [2] has recently brought various
breakthroughs in the field of machine learning [24]. It computes the weighted average of input features using the learning parameters, attention weights. Throughout this paper, we
use the term ”important feature/function” to denote a feature/function that is assigned a higher attention weight. Itmeans a feature/function that the model considers important forclassification. By focusing on important features for prediction,
high-performance prediction is achieved. Furthermore, it isexpected to obtain explanations for the predictions by extracting the important features. Our method incorporates attention
mechanism and tries to achieve both high-performance classification and interpretable explanations. In other words, we try
to extract reliable explanations for malware classifications andprovide features that characterize the classification classes.

Machine learning-based classification methods have been
actively studied to counter the threat of unknown malware.

When applying machine learning, it is necessary to determine a feature set to be used. Several granular features can be
designed to represent malware, including bytes, basic blocks,
and functions. The explanations for classification results are
extracted in feature units. If the granularity of the feature issmall, such as a byte or basic block, people have difficulty
understanding the explanations. Meanwhile, function is relatively superior in interpretability. When analyzing malware,
analysts often focus on its function and relevance. Therefore,
if the importance of each function is presented, they will easilyinterpret and utilize it for the analysis. In addition, malware
developers rarely create programs from scratch, and somefunctions are often used interchangeably. Therefore, we adopt
functions as features in this study.

Workshop on Binary Analysis Research (BAR) 2023
3 March 2023, San Diego, CA, USA
ISBN 1-891562-84-3
https://dx.doi.org/10.14722/bar.2023.23005
www.ndss-symposium.org

Graph Neural Network (GNN) was first proposed by
Scarselli et al. [17] and has attracted attention in various
fields, such as molecular and human relationships. It has also
been applied in malware classification in the past few years
and achieved high classification performance [30], [27]. GNN
classifies graphs using the graph structures that represent the

Malware classification, which identifies malware families
or categories, is helpful for efficient malware analysis. Static
analysis, which requires the interpretation of binary code, ishighly technical and time-consuming. In particular, detailed
analysis of unknown malware requires considerable effort. In
such cases, identifying malware species allows analysts to infer
their behavior. Attackers create numerous malware variants
that are sophisticatedly designed to evade traditional signaturebased detection. Signature-based methods cannot keep up withcreating pattern files and are limited in real-time response tovariants and new malware species.

format, which is an executable file format for Windows. Ma etal. [8] have demonstrated nine existing studies on the familyclassification of PE malware using four different datasets. In
this study, we compare our experimental results with those of
Ma et al. There are three main types of existing approaches:
image-based, binary-based, and disassembly-based, and our
proposed method is classified as a disassembly-based method.
The following subsections mainly focus on the methods used
for comparison in this study.

relationships between objects. Function Call Graph (FCG),
which represents the calling relationship between functions,can be used to represent a program as a graph structure. Wu
et al. [27] proposed GEMAL, a malware classifier using FCG
structure. They showed that GEMAL can classify malware
with high performance by evaluation experiments. In thisstudy, we use GNN to classify FCG in order to achieve highperformance classification.
Considering these backgrounds, we propose an interpretable malware classification method named FCGAT. It
classifies malware by focusing on important functions for classification and presents these functions as explanations. FCGAT
updates function features reflecting the calling relationships
between functions using FCG. Then, by incorporating attention
mechanism, FCGAT achieves both high-performance classification and interpretability.

A. Image-based methods
Image-based methods convert binary malware files intograyscale or color images and then adopt image classification
models for malware classification. This method was first proposed by Nataraj et al. [12]. Ma et al. used four different image
classification models in their comparison experiments (ResNet50 [5], VGG-16 [19], Inception-V3 [22] and IMCFN [23]).
Image-based methods can use existing image classification
models and are compatible with machine learning. However,since we aim to explain the classification reasons, explanations
by image pixels that are difficult to interpret are not appropriate.

The contributions of this study are as follows:•

We propose FCGAT, a novel malware classification
method that can explain the classification result on a
per-function basis. FCGAT provides analysts with animportance ranking of function, which is expected tobe effective in reducing the burden of following indepth analysis. To the best of our knowledge, this is
the first study to explain malware classification on a
per-function basis.

•

We evaluate the performance of FCGAT on two
datasets and compare it to existing methods. The
results show FCGAT succeeded in classification with
F1-Score 98.15% and 98.45%, which is comparable
to the cutting-edge methods. These results support theeffectiveness of malware classification using function
features.

•

We examine how much the important functions contribute to the classification. Surprisingly, only top 6(average per sample) important functions yield asmuch as 70% accuracy. This result suggests malware
can be analyzed by focusing on fewer features.

•

We analyze the explanations provided by FCGAT
and obtain insight into the functions that characterizemalware. As an example, we analyzed ransomware
samples and identified AES encryption and decryptionfunctions. The insights from these explanations could
be helpful for malware analysis and comprehensive
malware trend analysis.

B. Binary-based methods
Binary-based methods input the malware binaries andprocess them as time-series data. Raff et al. [15] proposed
MalConv, the first end-to-end malware detection model to takethe entire malware executable file as input. Qiao et al. [14]proposed a method combining Word2Vec [11] and Multi-Layer
Perceptron (MLP). This method first preprocesses to remove
meaningless bytes, and then the 256-byte embedding vectors
obtained by Word2Vec are input to the MLP classifier. The
binary-based approach has the advantage of low preprocessing
costs because it uses byte sequences in the executable file.
However, the problem is that adjacent bytes are not always
contextually meaningful since jump and function call instructions hop to a distanced address. Therefore, our method uses
FCG to provide a contextually meaningful representation.
C. Disassembly-based methods
In disassembly-based methods, features are created fromassembly code obtained by disassembling an executable file.
Our proposed method is classified as this approach. MAGIC by
Yan et al. [30] uses DGCNN [32], a type of GNN, to classify
Control Flow Graph (CFG) with the basic blocks as nodes.
MAGIC uses manually designed features of basic blocks.
Awad et al. [1] treat an opcode sequence as a document andapply Word2vec to obtain a vector representation of malware.
The k-Nearest Neighbor method is used for classification. In
MCSC by Ni et al. [13], opcode sequences are converted tovectors based on SimHash [9], and the imaged vectors areclassified using a convolutional neural network. Disassemblybased methods have lower performance than the other methods
in the Ma et al. experimental results. In MalwareBazaar
dataset, the average F1-Score for image-based methods is
96.65%, and binary-based is 97.1%, whereas disassemblybased is 91.98%, which is inferior to the other methods.
We aim to build a high-performance malware classifier using
function features, even with disassembly-based methods.

This paper is organized as follows. Section II surveys theworks related to machine learning-based malware classification. Section III describes the prior knowledge required for thispaper. In Section IV, our method is proposed. Our experimental
results are given in Section V. Section VI discusses ourapproach. In Section VII, conclusions are provided.
II.

R ELATED W ORK

Malware analysis methods can be broadly classified into
static analysis and dynamic analysis. Our method is classified
as a static analysis that does not run malware. Among them,this study is related to the malware classification method.
In addition, we target malware in Portable Execution (PE)2

COMBINE

Recently, Wu et al. [27] proposed GEMAL, a malware
classification method based on FCG. GEMAL uses Word2vec
to convert instructions into vectors and then adds the instruction vectors in a function to generate an embedded vector of
the function. For graph vectorization, GEMAL uses a graphembedding network based on an attention mechanism, inspiredby Massarelli et al. [10]. GEMAL successfully classified
malware families with 99.81% accuracy on Microsoft Malware
Classification Challenge dataset BIG-2015 [16]. This result
is a high performance compared to other existing studies.
Inspired by GEMAL we propose a new interpretable malware
classification method using FCG. In Wu et al. work, theinterpretability of GEMAL is not discussed. Since the sourcecode of GEMAL is not publicly available, we implemented
GEMAL based on the original paper [27] and the source code 1
by Massarelli et al. [10] from which GEMAL was derived. Wethen conduct a replication experiment and compare the resultswith our method.

updateAGGREGATEREADOUT

Fig. 1. Overview of graph classification process in GNN. This figure shows
the process of updating the features of the node v1 .

FCGs in which program functions are nodes and functions ina calling relationship are connected by edges.

D. Explanation techniques in malware classification

1) Graph definitions: A directed graph G = (V, E) isrepresented by a set of nodes V = {v1 , ..., vn } and a set ofedges E = {e1 , ..., en }. Each e = (u, v) ∈ E is an edge froma node u to v. For each node v, N (v) = {u | (u, v) ∈ E}
represents the set of adjacent nodes. Consider giving features
to nodes in this graph. Each node v has an initial feature vector
xv ∈ Rd , where d is a dimension of feature space. The total
number of nodes in the graph is n, and the feature matrix is
X ∈ Rn×d . Denote the latent feature vector of a node by hv
and that of the entire graph by hG .

Yakura et al. [29] proposed a method to extract malware
family-specific regions by using an image classification modelwith an attention mechanism. The input data are images scaled
to 64 x 64 resolution, and the outputs are attention maps
indicating important regions for classification. The attention
maps are expected to be useful for malware analysis because it
extracts byte sequences that characterize malware families. According to evaluation experiments, the performance of malware
family classification has an error rate of 50.97%, and it is statedin the paper that there is room for improvement in classification
accuracy. Therefore, we aim to create an interpretable modelwith higher classification performance.

2) Graph Classification in GNN: The process of graphclassification in GNN is divided into three major steps.
1)

In the latest study, Herath et al. [6] proposed CFGExplainer, an explanatory method in GNN-based malware classification models. CFGExplainer obtains the node importancein CFG subgraph by pruning nodes that do not contributeto classification and identifying the subgraphs that contributethe most to classification. Since CFGExplainer uses CFG, it
does not apply to our target FCG-based method. Herath et al.
analyzed malware behavior from a subgraph that is 20% of
the total CFG, but it is a daunting task to analyze a subgraphwith probably more than several thousand basic blocks. We
aim to make analysis more efficient by using FCG, which has
fewer nodes than CFG, to identify functions that are typicalof malware.
III.

2)
3)

AGGREGATE: Aggregate the features of neighbornodes.
COMBINE: Update the features of the node using
the features of the aggregated neighbor nodes.
READOUT: Obtain a representation of the entire
graph from the nodes in the graph.

The kth update formula for the node is represented as
hkv ← COM hk−1
, AGG hk−1,vu , ∀u ∈ N (v)where COM represents COMBINE function and AGG represents AGGREGARE function. The following explains the example in Fig. 1. The set of neighbor nodes of v1 is {v2 , v3 , v4 }.
k−1
k−1
Input their latent feature vectors {hk−1v2 , hv3 , hv4 } into the
AGGREGATE function. The output and the current feature
vector hk−1
are input to the COMBINE function, and thev1
output is updated as a new feature vector hkv1 . This process isrepeated for other nodes. Finally, READOUT summarizes thevectors of all nodes to obtain a single vector hG that represents
the entire graph. This process allows obtaining hG even if
the number of nodes varies from sample to sample. Various
methods have been proposed for READOUT processing, including sum, average, and maximum. Our proposed method
uses Set2Set [26] in this process and emphasizes the weightingof important functions with the attention weight.

P RELIMINARY

This section describes the prior knowledge required for thispaper.
A. Graph neural network (GNN)
GNN [17] have recently attracted attention in machinelearning and are expected to be applied to a wide range of areas
represented by graph structures, including networks, humanrelationships, and molecules [28]. GNN can perform several
tasks, such as node classification, graph classification, and link
prediction. In this study, we perform graph classification ofIV.

P ROPOSED M ETHOD

An overview of the proposed method FCGAT is shown in
Fig. 2. FCGAT consists of three parts: FCG creation, function

1 https://github.com/lucamassarelli/Unsupervised-Features-Learning-ForBinary-Similarity

3

Network (GAT) [25]. The features of the nodes are updated by
the following:feature creation, and malware classification. FCGAT takes abinary file as input. A FCG is created from a binary file,and feature vectors of functions extracted using Word2vec are
assigned as the node features in the graph. Finally, FCGAT
classifies malware class by GNN using the FCG as input.

ui = LeakyReLU(W1 xvi+ LeakyReLU(∥K
k=1

X

k
αij
Wk xj )),

xj ∈N (vi )A. Creation of Function Call Graph

where xvi is the initial function vector at a node to be updated,
xj ∈ N (vi ) is the neighbor of the node, W1 and Wk
are the learning parameters. Multi-head Attention is used toconcatenate the results from K-independent Attention mechanisms. The αij represents the importance between nodes. αij
is learned by the following:
αij = softmaxj LeakyReLU a⊤ W2 xvi ∥W2 xvj.

FCG is a directed graph where nodes represent functions
and edges represent function calls. Although a general FCG
connects edges from the calling function to the direction ofcalled function, FCGAT reverses this arrow. In programs, thecalled function can be nested within the calling function.
Therefore, the features of the called function should be aggregated in the calling function, thus reverse FCG is used. In
a general FCG, the ends of the arrows usually represent API
functions (often API wrappers). That is, FCGAT aggregate thefeatures of API functions into the calling functions.

The GAT layer’s attention mechanism is not used for interpretation. This is because αij given for each edge depends on thenumber of neighbors, making it hard to reflect the importanceof a node. For example, if there is only one neighbor, αij willbe the maximum possible value of 1, even if the node is notimportant. In this layer, Multi-head Attention has the effect of
expanding representation, which improves performance.

B. Function feature creation
This module converts assembly functions into function
vectors that can be handled by machine learning. These function vectors need to reflect the semantics of the functions inorder to classify malware with high performance. FCGAT uses
CBOW model of Word2vec [11] to obtain instruction vectors
corresponding to assembly instructions. This method is basedon natural language processing techniques, where instructions
correspond to words and functions correspond to sentences.
CBOW model obtains instruction vectors by predicting thecurrent instruction from surrounding instructions. Word2vec
uses unsupervised learning and does not require any priorknowledge. This method is well suited for learning featuresof malware functions that are difficult to label, unlike opensource programs.

FCGAT does not convolve the features of the updating
node but only aggregates the features of the neighbors. The
features of the updating node are converted to the hidden
layer dimension at the fully connected layer (corresponding
to W1 xvi ) and added to the output of GAT.
Next, the readout process uses Set2Set [26], which is the
key to interpretability, to obtain the feature vector of the entire
graph as follows:
qt = LSTM(q∗t−1 )′αi,t= softmax(ui · qt )Since assembly instructions contain numerical values suchas memory addresses and offset values, the vocabulary becomes excessively large if used as is. Therefore, the assembly
instructions are filtered as follows:
1)
2)
3)

rt =

N
X

′
αi,t
ui

i=1

q∗t = qt ∥rt .
Set2Set is an extension of the seq2seq [21] approach to support
unordered sets. That is, permuting ui and ui′ has no effect on
the read vector rt . The ordering of the nodes in FCG depends
on the starting address of the function, but this ordering is
usually meaningless. Thus FCG is considered suitable to beprocessed by Set2Set. Fig. 3 shows an overview of Set2Set
process and how it explains the classification results. FCGAT
can apply the attention mechanism to the variable numberof nodes by using LSTM, and we expect that the featuresof nodes that are important for classification are given highattention. In other words, we can obtain the important functions′
by analyzing the value of αi,t. Based on attention weights in′the final step of Set2Set, function name and importance αi,tare provided as an importance ranking. In order to reflect theimportance for classification to the attention weight, simple
network structures are adopted for the other parts. For example,
only one convolution in GAT is used to avoid excessively
diluting the original function’s features.

Remove ”,” and comments after ”;”.
Replace the number with ”N”.
Connect operand and opcode with ” ”.

This filtering makes use of the analysis results of analysis tool.
In our implementation, we use IDA Pro as the analysis tool.
IDA Pro converts well-known functions, such as API functions,from addresses to function names so that instruction vectors
can reflect the characteristics of well-known function names.
After creating the instruction vectors in the CBOW model,
FCGAT averages the instruction vectors in the function to
obtain a function vector. This vector is assigned as the featureof a node in a FCG.
C. Malware classification model
The structure of the classification model is shown in
Fig. 2. The inputs are FCGs with function feature vectors as
node features. The FCGs are convolved with Graph Attention

Finally, classification is performed in a Fully Connected
layer. This layer takes a graph vector hG as input and outputs
4Classifier

Preprocesing

CAT

Function Call Graph
entry0Assembly
Instruntions

Malwarefunc.aafunc.bb[0.01,-0.6,…0.02]
・・・

func.xx

Fig. 2.

avg.

[-0.3,…,0.04][0.08,…,0.03]…

…

Word2vec
Instruntion
Vectors

L
e
a
k
y
R
e
L
U

…

Dropout edge
0.5

[0.04,…,0.01]

Function vectors

L
e
a
k
y
R
e
L
U

Set2Set

:

…
…
:
…

Fully Connected

Attributed
Function Call Graph

Fully Connected
Dropout
0.5:

Overview of our proposed method FCGAT.
TABLE I.
Layer
GAT
FC
Set2SetFC

C LASSIFICATION MODEL PARAMETERS(In, Out)(100, 192)
(100, 192)
(192, 384)
(384, Number of classes)

Activation
LeakyReLU
LeakyReLU

Remark
K=3
steps = 4

Softmax

A. Experimental setup
We implemented FCGAT using Python, PyTorch 1.11.0,
and PyTorch Geometric 2.0.2, a library for GNN. FCGAT
uses a reverse engineering tool IDA Pro for preprocessing.
IDA Python is used to automate operations in CUI, andida gdl.gen simple call chart function is used to create FCG.
For function feature creation, Gensim library is used tocreate the CBOW model. When evaluating performance, only
train data is used to create CBOW training models, which arethen used for the evaluation of test data. We choose parameters
embedding size 100, windowsize 2, epochs 100 for the CBOW
model. Where, embedding size is the dimension of the feature
vector of the function, and window size is the number ofsurrounding words to be considered. In other words, instruction
vectors are learned from the two instructions before and after.

Fig. 3. An overview of Set2Set process and how it explains the classification
results.

For training the classification model, we choose learning
rate 0.001, mini-batch size 256, and epochs 700. The model
parameters are shown in TABLE I.

a vector representing the classification probabilities of theclasses as follows:p = softmax(W3 hG ),B. Classification performance evaluation

where W3 is a learninig parameter. The index with the highest
value among the p elements indicates the predicted class.

In this experiment, we evaluate the performance of FCGAT
on two datasets and compare it with the demonstration resultsof existing research by Ma et al. [8]. We also compare with
GEMAL by Wu et al. [27]. We implemented and performed a
replication experiment with GEMAL to compare on the samedataset.

We adopt Dropout [20] to prevent overfitting and stabilize
learning. Dropout randomly drops layer outputs to 0 during
training to enable correct recognition even if some data are lost.
It helps avoid overfitting some local features and improves therobustness of the model. In Fig. 2, Dropout 0.5 means dropping
the node’s output to 0 with 0.5 probability. In addition, crossentropy is used as the error function, and AdamW [7] is usedas the optimization algorithm.
V.

1) Datasets: We used two datasets that Ma et al. used intheir experiments on existing studies. We created FCGs andthe function vectors for each dataset using FCGAT. Then, thefunction vectors were assigned to the nodes of the FCG, anddatasets with graph format were created. We used the following
datasets.

E VALUATION

We evaluated FCGAT in terms of classification performance (in Section V-B) and classification interpretability (inSection V-C). Before delving into them, we describe theexperimental setup common to both. Our research artifacts areavailable on Github 2 .

a) MalwareBazaar dataset: MalwareBazaar dataset
was published by Ma et al. [8]. MalwareBazaar 3 is a websitethat provides malware for research purposes. Ma et al. createdthe dataset using the following procedure. First, they selected

2 https://github.com/som3ya/FCGAT

3 https://bazaar.abuse.ch

5

TABLE II.

M ALWARE BAZAAR

FamilyGozi
GuLoader
Heodo
IcedID
njrat
Trickbot
Total

Counts
767
589
214
578
939
881
3,968

TABLE III.
FamilyRamnitLollipop
Kelihos ver3
Vundo
Simda
TracurKelihos ver1
Obfuscator.ACY
Gatak
Total

BIG-2015

3) Experimental results: TABLE IV shows the results ofthe evaluation metrics computed and compared with the existing studies. For GEMAL, we adopt the results of replication
experiments to evaluate performance instead of the paper
values because we cannot compare them with MalwareBazaar
dataset based on the paper values.

Counts
1,533
2,475
2,938
453
42
751
387
1,217
1,012
10,808In MalwareBazaar dataset, FCGAT successfully classifies
with an F1-Score of 98.15% and outperforms all other methodson all metrics. In BIG-2015, the F1-Score of FCGAT is
98.18%, which is about equivalent to 98.37% in the GEMAL
replication experiment.

the top six malware families from the malware released in 2020
on MalwareBazaar and downloaded 1000 malware samples
from each family. Next, they filtered out samples that were
not in PE format and used Joe Security 4 and AVClass [18] tocheck the label of each sample and to determine whether thelabel removed inconsistent samples. As a result, they obtained
3,971 samples from 6 families. Ma et al. published a list ofhash values and family names of the samples on their GitHub 5 .
We downloaded 3,971 malware samples using this list and
MalwareBazaar’s API. We used 3,968 samples (TABLE II) thatwere successfully preprocessed for the evaluation experiments.

As noted in Section II-C, the disassembly-based methods
perform poorly in the Ma et al. experiments, especially in
MalwareBazaar dataset. The reason is considered that thesemethods do not use the PE header feature of executables. It
has been noted that models that take the entire executable fileas input, such as MalConv [15], tend to mainly pay attention to
the PE header in malware classification [4]. However, classifying malware by focusing on PE headers is risky because
PE headers contain information that can be spoofed (e.g.,timestamps). FCGAT outperforms the methods that use theentire files, even though it only uses code segment features.
We think that FCGAT is able to represent malware features
more accurately by extracting features on a function basis.

b) BIG-2015: The second dataset is BIG-2015 [16],provided by Microsoft, which consists of 10,868 samples
from 9 families. Each sample consists of .byte files, a binary
representation of a hexadecimal number, and .asm files, thedisassembly outputs of IDA Pro. In this experiment, we created
FCGs from .asm files and extracted function binaries. 10,810
samples (TABLE III) that were successfully preprocessed wereused in the evaluation experiment.

C. Classification interpretability
In this experiment, we perform malware category classification by FCGAT and extract the importance ranking of
the functions as explanations, and verify the effectivenessof these explanations. Malware category indicates malware
features such as Downloader, Ransomware, and Trojan. We
expect FCGAT to focus on malware features by classifying
them into malware categories rather than families. That is, wepredict that the important function will be network communication functions for Downloader and encryption functions for
Ransomware.

2) Evaluation metrics: We use the same evaluation metrics
as in the experiment of the comparator Ma et al. Four evaluation metrics are used: Accuracy, Precision (Pmacro ), Recall(Rmacro ), and F1-Score (F 1macro ). Each formula is expressed
as following:
PN PM
Accuracy = ( n=1 m=1 T Pmn )/SP
N
Pmacro =
P
/N
n
n=1
P

N
Rmacro =n=1 Rn /NP
N
F 1macro =n=1 F 1n /N

1) Datasets: We used a dataset named BODMAS-8cat,
modified from BODMAS [31]. BOSMAS was published by
Yang et al. and contains 57,293 executables labeled by 581
families and 14 categories. In this experiment, we excluded
as many packed files as possible to focus on the malware
features. We excluded from BODMAS those samples that havebeen pack-detected by PEiD 6 . Then, the category with morethan 90 samples in each malware category was selected among
the successfully preprocessed samples. As a result, BODMAS8cat was created, containing 23,369 samples in 8 categories,
as shown in TABLE V.

where
 P

M
(T
P
+
F
P
)
/
mn
mn
m=1

P
 P
M
M
Rn =
m=1 (T Pmn + F Nmn )m=1 T Pmn /
Pn =

P

M
m=1 T Pmn

2) Contributions of important functions: In this section,
we examine how much the important functions contributeto the classification. Before that, we evaluate FCGAT using
BODMAS-8cat with 8:2 hold-out validation. The classification performance of the test data was accuracy of 95.04%.
Malware category classification is a more difficult than familyclassification due to labeling difficulties. However, FCGAT isable to classify with sufficiently high performance, and the
explanations for classification are considered reliable.

F 1n = (2 ∗ Pn ∗ Rn ) / (Pn + Rn )N is the number of all classes, S is the number of all
samples, and M is the number of cross-validation splits.
T Pmn , F Pmn and F Nmn represent the true positive, false
positive, and false negative of malware family n in the mfold.
4 https://www.joesecurity.org
5 https://github.com/MHunt-er/Benchmarking-Malware-FamilyClassification

6 https://www.aldeid.com/wiki/PEiD

6

TABLE IV.
Category

Image

BinaryDisassembly

C OMPARISON OF EXPERIMENTAL RESULTS WITH THOSE IN EXISTING STUDIES .

Model
ResNet-50 [5] *VGG-16 [19] *Inception-V3 [22] *IMCFN [23] *CBOW+MLP [14] *MalConv [15] *MAGIC [30] *Word2vec+KNN [1] *MCSC [13] *FCGAT(proposed method)
GEMAL(replication) [27]
GEMAL(paper) [27] †Accuracy
96.68
96.35
95.83
97.38
97.81
95.92
92.82
95.64
96.80
98.11
97.71
-

MalwareBazaar dataset
PmacroRmacro
96.91
96.75
96.58
96.54
95.67
95.79
97.53
97.41
97.92
98.08
96.04
96.43
88.03
87.36
93.34
94.29
94.97
94.51
98.03
98.27
97.65
98.00
-

F1macro
96.83
96.56
95.73
97.47
98.00
96.20
87.45
93.79
94.70
98.15
97.82
-

Accuracy
98.42
93.94
96.99
97.77
98.41
97.02
98.05
98.07
97.94
99.27
99.37
99.81

BIG-2015
PmacroRmacro
96.57
95.68
90.32
81.89
93.67
94.46
95.93
94.81
97.63
96.67
94.34
92.62
96.75
94.03
96.41
96.51
95.97
96.17
97.93
98.45
98.26
98.48
-

F1macro
96.08
87.27
94.03
95.13
97.12
93.33
95.14
96.45
96.06
98.18
98.37
99.81

* and † mean the experimental results by Ma et al. [8] and Wu et al. [27], respectively. The top two in each evaluation metric are shown in bold.
In MalwareBazaar dataset, FCGAT outperformed all other methods on all metrics. In BIG-2015, the F1-Score of FCGAT is 98.18%, which is about
equivalent to 98.37% in the replication experiment of GEMAL.

TABLE V.
Category
backdoor
downloader
dropper
informationstealerransomware
trojan
virus
worm
total

D ETAILS OF BODMAS-8 CAT.
Family Counts
31
19
17
19
18
282
8
87
481

Sample Counts
598
967
397
347
169
15,67493
5,124
23,369To verify that the attention weights reflect the contributing
functions for the classification, we evaluate classification performance using only important functions with higher attention
weights. This evaluation method is based on the method of
Herath et al. [6]. We create subgraph datasets consisting offunctions with high attention weights by varying the numberof nodes, and evaluate their performance. If FCGAT focuses
on functions that highly contribute to the classification, theperformance of the subgraph should be close to that of theoriginal graph (100%subgraph).

Fig. 4. The classification accuracy of subgraphs. Graph size means the ratioof the number of nodes in the subgraph to those in the original graph. Between
1 and 40% of the graph size, performance does not decrease as the numberof nodes is reduced, and even a graph size as small as 1% shows about 70%
accuracy.
TABLE VI.

AVERAGE NUMBER OF NODES AND CLASSIFICATION
ACCURACY OF SUBGRAPHS .

Graph Size (%)
1
5
10
20
30
40
50
60
70
80
90
100

As mentioned in Section IV-C, we can obtain the importantfunctions by analyzing attention weights in Set2Set. The
specific procedures are as follows. First, we create a trainedmodel using all BODMAS-8cat samples. Next, we perform
category classification of BODMAS-8cat samples with thetrained model and calculate the attention weights corresponding to each function in each sample. We use attention weight′
αi,4of the fourth step in Set2Set. Finally, we create subgraphs
consisting of nodes from 1 to 100% of the original graph,ordered by attention weight, and calculate the accuracy of themalware categories as predicted by the trained model.

Average Number of Nodes
6.2
28.8
56.9
113.4
170.1
226.5
283.0
339.6
396.2
452.7
509.3
565.4

Accuracy
69.67
70.53
71.73
72.48
68.57
68.99
78.20
83.06
82.40
85.96
88.92
95.06

Even though the average number of nodes in the 1% subgraphis only about 6, it achieves 69.67% accuracy. This means that
only about 6 functions can characterize malware.

Fig. 4 shows the classification accuracy against Graph Sizefor the subgraphs, and TABLE VI shows the average numberof nodes and classification accuracy for the subgraphs. While
the accuracy in the original graph is 95.06%, the 1% subgraphwith only 6 nodes on average achieves 69.67%, higher than our
intuition. This result supports the claim that FCGAT focuses
on functions that highly contribute to classification and implies
that only about 6 functions can characterize malware.

different graph structure from our FCG. The nodes in CFG arebasic blocks, which are less granular than functions, making
it difficult to characterize malware with fewer basic blocks.
We believe that FCGAT can reduce the analysis workload byproviding the analysts with reliable explanations with fewer
functions.

In the experiment by Herath et al. [6], the 10% subgraphcreated by CFGExplainer showed 52.39% accuracy. In contrast, the 10% subgraph created by FCGAT achieves 71.73%
accuracy. Note that CFGExplainer uses CFG, which has a3) Trend analysis of malware categories: In this section,
we analyze the important functions and show that it is possible
to analyze trends in the malware category by identifying
typical functions for each category.
7

We have seen important functions for malware classification. FCGAT seems to identify particularly similar samples
within classes and focuses on functions common to them. As
a result, we have found many API functions that were often
common to multiple samples. By utilizing this method, it will
be possible to comprehensively analyze the characteristics ofmalware categories.

We extracted the most important functions for each sample
by analyzing the attention weights as follows:
1)
2)
3)

Create a trained model of FCGAT using all samples
in BODMAS-8cat.
Perform inference on all samples with the trained′model and calculate the attention weight αi,4of thefourth step in Set2Set.
′
Functions with the max αi,4are aggregated for eachcategory. In this process, function names generated
by IDA Pro are used to determine the function
identities. IDA Pro uses the symbol name of thefunction if symbol data is available. Otherwise, thefunction name is generated based on the address
reference. For sub [start address] and start, which
are considered to have no correspondence between
function name and code, the md5 hash of the function
vector is calculated and the function name is changed
to sub [hash value] and start [hash value] before
aggregation.

4) Case study: Ransomware/ GandCrab: GandCrab is ransomware that appeared in 2018. Here we will discuss two
samples of GandCrab, GandCrab#1 and GandCrab#2, andexamine which functions FCGAT focuses on.
The importance ranking of the functions and their attention
weights are shown in TABLE VIII. The functions aes encryptand aes decrypt are at the top of the ranking for both samples.
As the name implies, aes encrypt and aes decrypt functions
perform encryption and decryption of AES ciphers, and well
represent features of ransomware. These functions were named
by IDA Pro’s Lumina server, which stores metadata for wellknown functions.
GandCrab#1 is a DLL file, and GandCrab#2 is an EXE
file. Their program structures are quite different. However, they
were correctly classified by focusing on the common functions,aes encrypt and aes decrypt. FCGAT seems to be able tocapture the characteristics of programs that are semanticallysimilar but structurally and syntactically different. In this case,the function names were named by the Lumina server, so it iseasy to guess the behavior from the function names. However,even if it were difficult to guess from the function names (e.g.,
sub 420000), FCGAT can focus on the characteristic functions
because it uses features of assembly code. We consider thatthese explanations can be useful for malware analysis.

In this way, each sample’s functions with the max attention
weight are summarized for each category, and the top eight are
shown in TABLE VII.
The results provide insight into the functions that are typical for each category. Especially in the case of API functions,
it is easy to infer behavior from the function name. We will
focus on some characteristic functions.
Backdoor is placed on the victim machine by attackers, enabling it to be controlled remotely. Thus, GetCommandLineA
reflects the feature of reading command line parameters. Thisfunction is found in common with the malware families gbot
and zegost. The user-defined function sub 4f847a1 performs
XOR operations, which Malware often uses XOR operations
to obfuscate malicious data or code.

VI.

D ISCUSSION

A. Effectiveness of our method

In downloader, we can see that FCGAT focused on InternetOpenW which is used when downloading another malware
from the Internet. This result highly reflects the characteristics
of downloader.

We will discuss the effectiveness of our proposed methodby comparing it with existing studies. In the same way as
GEMAL [27], FCGAT uses FCG for malware classification,and both have succeeded in high-performance classification in
evaluation experiments (Section V-B3). They differ mainly inthe readout process. GEMAL uses a fully connected layer tolearn the attention weight and thus requires a constant numberof nodes in the input graph. That is, the number of functions
must be constant for all samples. GEMAL truncates nodes
greater than 200 and zero-padded for fewer. However, themaximum number of nodes in the MalwareBazaar Dataset
is 10,789 and in BIG-2015 it is 14,716. For samples withmany functions, functions that characterize malware may betruncated. On the other hand, FCGAT adopts Set2Set for
the readout process and uses LSTM to achieve an attention
mechanism for a variable number of nodes. Therefore, we
believe that FCGAT is superior to GEMAL in terms of modelinterpretability.

Dropper is a program that creates and drops files containing
malicious code from itself. CheckSumMappedFile calculates a
new checksum for the file and returns it with the CheckSum
parameter. Malware sometimes copies a binary executable
to a file in a temporary path, maps the file to memory,and then calls CheckSumMappedFile to verify the checksum.
imp VirtualProtect and ShellExecuteA are used to execute
shell code.
Informationstealer includes the blocker, zbot, and otherfamilies.GetFocus, typical of this class, gets a handle to thewindow that has keyboard focus. This function is found incommon with blocker.
In trojan, the samples in which sub a9f1051 is the mostimportant function are packed. We used PEiD to exclude
as many packed samples as possible but could not exclude
packers that did not match the PEiD signatures. However,
FCGAT captures the characteristics of packers and tends toclassify the same packers into the same class. Dealing withpacked samples is future work.

As described in Section II-D, Yakura et al.’s method [29]and CFGExplainer [6] have different feature units from our
method. Yakura et al. state that the byte sequence of theoriginal executable can be identified by extracting the pixel
regions of the image. However, the classified images arecompressed to 64 × 64 resolution, and it is suspicious whether
8TABLE VII.
backdoor
CreateFileA
fclosesub 4f847a1
SetWindowLongA
GetCommandLineA
sub a9f1051
sub cf1fee5
fdopenransomware
CoRegisterMallocSpy
CoReleaseMarshalData
InternetReadFile
ReadFile
SetPropA
SwitchDesktop
IsProcessorFeaturePresent
CreateOleAdviseHolder

119
105
83
74
47
29
18
17
34
22
19
12
11
11
10
7

AGGREGATE RESULTS FOR FUNCTIONS WITH MAX ATTENTION WEIGHTS .

downloader
InternetOpenW
MessageBoxA
mciSendStringA
sub f9da9b9
sub 1236153e
DispatchMessageA
UpdateWindow
CoUninitialize
trojansub a9f1051
vbaUI1I4
CloseHandle
InternetOpenW
GetSystemDirectoryAsub acc2cf0
OleSetMenuDescriptor
rtcLowerCaseVar

260
130
77
61
48
34
29
27
1,316
1,036
709
633
512
510
472
388

dropper
sub 460d8c2
GetWindowThreadProcessId
CheckSumMappedFile
IIDFromString
IsProcessorFeaturePresent
sub 62922e7
imp VirtualProtect
ShellExecuteA
virus
GetActiveWindow
strcpystart 80bc47b?ProcessWndProcException
nullsub 3
CoUninitialize
GetFileVersionInfoSizeW
EnableMenuItem

informationstealer
GetFocus
mciSendStringA
dllonexit
free
CreateFileA
sub d0f95e9
lstrcatA
GdipCreateFromHDC
worm
abnormal termination
EnterCriticalSection
sub f7f9a83
ZNSt6locale5 ImplC2Ej
ZNSt6locale5 ImplC1Ej
sub d0f95e9
ZNSt6locale6globalERKS
SetWindowsHookExA

278
48
17
14
4
3
2
2
38
31
15
2
2
1
1
1

202
47
11
10
9
8
7
7
1,314
892
407
255
205
188
182
158

This table shows the most important functions and their counts, aggregated by category. The results provide insights into the functions typical of themalware category.

TABLE VIII.

I MPORTANCE RANKING OF FUNCTION .

GandCrab#1
function
α′i,4
aes encrypt0.59840.4015aes decrypt
sub 10007BB0
2.002e-06
sub 10003F70
4.166e-07
7.423e-10
sub 10004C20

GandCrab#2
function
aes encryptaes decrypt
SetHandleInformation
GetTickCount
InitializeCriticalSection

malware obfuscated by packers. The packed program contains
a decompression processing code for each type of packer.
Therefore, it is likely to be able to capture the characteristics
of packers and thus be applicable to packer estimation task.

α′i,40.03310.00840.00800.00800.0080VII.

These samples are common to the top two important functions,aes encrypt and aes decrypt, which are characteristic of ransomware.

C ONCLUSION

We have presented FCGAT, a malware classification
method that can explain classifications by functions. Evaluation experiments showed that FCGAT classifies malware with
sufficiently high performance compared to the latest methods.
We then analyzed the explanations for the classification results
based on the attention weight of the classification model. The
results show that these explanations provide functions that reflect the malware features. In addition, we performed malware
classification on the subgraphs with top important functions.
Surprisingly, our result shows that only top 6 (average persample) of important functions contribute to the classification
result with almost 70% of accuracy. Malware families canbe characterized by considerably fewer functions than our
intuition. FCGAT is expected to improve the efficiency of
malware analysis and comprehensive malware trend analysis.
For example, it can be combined with existing tools, such as
IDA Pro, to highlight functions specific to the malware.

the corresponding byte sequence can be identified from thepixel area. In addition, this method had a classification errorof 50.97% for malware families, and low classification performance was mentioned as a problem. On the other hand, ourmethod successfully classified malware with high performance,with an F1-Score of over 98%, and both high-performance andinterpretable malware classification were achieved.
CFGExplainer obtains explanations for classification inunits of basic blocks. As seen in Section V-C2, the classification performance of CFGExplainer is significantly degradedfor subgraphs with a small number of nodes because basic
blocks are less granular than functions. Therefore, to identify subgraphs that highly contribute to classification, it isnecessary to increase the number of nodes in the subgraph,
which increases the effort of manual analysis. In this regard,
FCGAT can identify subgraphs with fewer nodes and higher
contribution to classification, with an average of 6 nodes still
performing 69.67% of accuracy.

T OOLS
The research artifacts are available at the following URL:
https://github.com/som3ya/FCGAT

These existing studies provide analysis cases for individual
samples, but they do not analyze to characterize the class of theentire dataset. That is, some samples can provide interpretable
explanations for classification, but others may not be well
explained. We have confirmed that the important functions
reflect the trend of malware categories in Section V-C3. FCGAT extracts the explanations on a per-function basis, whichenables aggregating the characteristic functions for each classand identifying trends.

ACKNOWLEDGMENT
Part of this work was supported by Innovative Science andTechnology Initiative for Security Grant Number JPJ004596,
ATLA, Japan.
R EFERENCES[1]

Y. Awad, M. Nassar, and H. Safa, “Modeling Malware as a Language,”2018 IEEE International Conference on Communications (ICC), pp.
1–6, May 2018.
[2] D. Bahdanau, K. Cho, and Y. Bengio, “Neural machine translation by
jointly learning to align and translate,” in 3rd International Conference
on Learning Representations, ICLR 2015, San Diego, CA, USA, May
7-9, 2015, Conference Track Proceedings, 2015.

B. Limitations
Similar to existing static analysis methods, our proposed
method is challenging to perform malware classification for the
9

[3]

[4]

[5]

[6]

[7]

[8]

[9]

[10]

[11]

[12]

[13]

[14]

[15]

[16]
[17]

[18]

[19]

[20]

[21]

[22]

A. Barredo Arrieta, N. Daz-Rodrguez, J. Del Ser, A. Bennetot, S. Tabik,
A. Barbado, S. Garcia, S. Gil-Lopez, D. Molina, R. Benjamins,
R. Chatila, and F. Herrera, “Explainable Artificial Intelligence (XAI):
Concepts, taxonomies, opportunities and challenges toward responsible
AI,” Information Fusion, vol. 58, pp. 82–115, Jun. 2020.
S. Bose, T. Barao, and X. Liu, “Explaining AI for malware detection:
Analysis of mechanisms of MalConv,” in 2020 International Joint
Conference on Neural Networks (IJCNN). IEEE, Jul. 2020.
K. He, X. Zhang, S. Ren, and J. Sun, “Deep Residual Learning for
Image Recognition,” 2016 IEEE Conference on Computer Vision and
Pattern Recognition (CVPR), pp. 770–778, Jun. 2016.
J. D. Herath, P. P. Wakodikar, P. Yang, and G. Yan, “CFGExplainer:
Explaining Graph Neural Network-Based Malware Classification fromControl Flow Graphs,” in 52nd Annual IEEE/IFIP International Conference on Dependable Systems and Networks, DSN 2022. IEEE, 2022,
pp. 172–184.
I. Loshchilov and F. Hutter, “Decoupled weight decay regularization,” in
7th International Conference on Learning Representations, ICLR 2019,2019.
Y. Ma, S. Liu, J. Jiang, G. Chen, and K. Li, “A comprehensive
study on learning-based PE malware family classification methods,”
Proceedings of the 29th ACM Joint Meeting on European Software
Engineering Conference and Symposium on the Foundations of Software
Engineering, pp. 1314–1325, Aug. 2021.
G. S. Manku, A. Jain, and A. Das Sarma, “Detecting near-duplicates
for web crawling,” in Proceedings of the 16th international conferenceon World Wide Web - WWW ’07. Banff, Alberta, Canada: ACM Press,
2007, p. 141.
L. Massarelli, G. A. Di Luna, F. Petroni, L. Querzoni, and R. Baldoni,“Investigating Graph Embedding Neural Networks with Unsupervised
Features Extraction for Binary Analysis,” Proceedings 2019 Workshop
on Binary Analysis Research, 2019.
T. Mikolov, K. Chen, G. Corrado, and J. Dean, “Efficient Estimation ofWord Representations in Vector Space,” in 1st International Conference
on Learning Representations, ICLR 2013, Scottsdale, Arizona, USA,May 2-4, 2013, Workshop Track Proceedings, Jan. 2013.
L. Nataraj, S. Karthikeyan, G. Jacob, and B. S. Manjunath, “Malware
Images: Visualization and Automatic Classification,” in Proceedings of
the 8th International Symposium on Visualization for Cyber Security VizSec ’11. Pittsburgh, Pennsylvania: ACM Press, 2011, pp. 1–7.
S. Ni, Q. Qian, and R. Zhang, “Malware identification using visualization images and deep learning,” Computers & Security, vol. 77, pp.
871–885, Aug. 2018.
Y. Qiao, B. Zhang, and W. Zhang, “Malware Classification Method
Based on Word Vector of Bytes and Multilayer Perception,” ICC 2020
- 2020 IEEE International Conference on Communications (ICC), pp.
1–6, Jun. 2020.
E. Raff, J. Barker, J. Sylvester, R. Brandon, B. Catanzaro, and C. K.
Nicholas, “Malware Detection by Eating a Whole EXE,” in Workshops
at the Thirty-Second AAAI Conference on Artificial Intelligence, 2018.
R. Ronen, M. Radu, C. Feuerstein, E. Yom-Tov, and M. Ahmadi,“Microsoft Malware Classification Challenge,” ArXiv, Feb. 2018.
F. Scarselli, M. Gori, Ah Chung Tsoi, M. Hagenbuchner, and G. Monfardini, “The Graph Neural Network Model,” IEEE Transactions on
Neural Networks, vol. 20, no. 1, pp. 61–80, Jan. 2009.
M. Sebastián, R. Rivera, P. Kotzias, and J. Caballero, “AVclass: A
Tool for Massive Malware Labeling,” vol. 9854.
Cham: Springer
International Publishing, 2016, pp. 230–253.
K. Simonyan and A. Zisserman, “Very Deep Convolutional Networks
for Large-Scale Image Recognition,” in 3rd International Conference
on Learning Representations, ICLR 2015, Sep. 2014.
N. Srivastava, G. E. Hinton, A. Krizhevsky, I. Sutskever, and
R. Salakhutdinov, “Dropout: a simple way to prevent neural networks
from overfitting,” J. Mach. Learn. Res., vol. 15, no. 1, pp. 1929–1958,
2014.
I. Sutskever, O. Vinyals, and Q. V. Le, “Sequence to Sequence Learningwith Neural Networks,” in Advances in Neural Information Processing
Systems, vol. 27. Curran Associates, Inc., 2014.
C. Szegedy, V. Vanhoucke, S. Ioffe, J. Shlens, and Z. Wojna, “Rethinking the inception architecture for computer vision,” in 2016 IEEE

[23]

[24]

[25]

[26]
[27]

[28]

[29]

[30]

[31]

[32]

10

Conference on Computer Vision and Pattern Recognition (CVPR), Jun.
2016, pp. 2818–2826.
D. Vasan, M. Alazab, S. Wassan, H. Naeem, B. Safaei, and Q. Zheng,“IMCFN: Image-based malware classification using fine-tuned convolutional neural network architecture,” Comput. netw., vol. 171, no. 107138,
p. 107138, Apr. 2020.
A. Vaswani, N. Shazeer, N. Parmar, J. Uszkoreit, L. Jones, A. N. Gomez,
L. Kaiser, and I. Polosukhin, “Attention is all you need,” in Advancesin Neural Information Processing Systems, I. Guyon, U. V. Luxburg,
S. Bengio, H. Wallach, R. Fergus, S. Vishwanathan, and R. Garnett,
Eds., vol. 30. Curran Associates, Inc., 2017, pp. 5998–6008.
P. Veličković, G. Cucurull, A. Casanova, A. Romero, P. Liò, and
Y. Bengio, “Graph Attention Networks,” 6th International Conference
on Learning Representations, ICLR 2018, 2018.
O. Vinyals, S. Bengio, and M. Kudlur, “Order Matters: Sequence tosequence for sets,” 2015.
X.-W. Wu, Y. Wang, Y. Fang, and P. Jia, “Embedding vector generation
based on function call graph for effective malware detection andclassification,” Neural Computing and Applications, vol. 34, no. 11,
pp. 8643–8656, Jun. 2022.
Z. Wu, S. Pan, F. Chen, G. Long, C. Zhang, and P. S. Yu, “A
Comprehensive Survey on Graph Neural Networks,” IEEE Transactions
on Neural Networks and Learning Systems, vol. 32, no. 1, pp. 4–24,
Jan. 2021.
H. Yakura, S. Shinozaki, R. Nishimura, Y. Oyama, and J. Sakuma,“Neural Malware Analysis with Attention Mechanism,” Comput. Secur.,vol. 87, 2019.
J. Yan, G. Yan, and D. Jin, “Classifying Malware Represented as Control Flow Graphs using Deep Graph Convolutional Neural Network,”
2019 49th Annual IEEE/IFIP International Conference on Dependable
Systems and Networks (DSN), pp. 52–63, Jun. 2019.
L. Yang, A. Ciptadi, I. Laziuk, A. Ahmadzadeh, and G. Wang, “BODMAS: An Open Dataset for Learning based Temporal Analysis of PE
Malware,” in IEEE Security and Privacy Workshops, SP Workshops
2021. IEEE, 2021, pp. 78–84.
M. Zhang, Z. Cui, M. Neumann, and Y. Chen, “An end-to-end deeplearning architecture for graph classification,” in AAAI Conference on
Artificial Intelligence, 2018.