## 4 Proposed Approach and Experiments
### Proposed Framework  
This work presents a novel malware detection framework that integrates graph-based methodologies with DL approaches. The proposed model uses Node2 Vec, GAT, and CNN-GRU-3 in a novel structure to exploit structural and contextual relationships in malware data. The overall proposed framework is shown in Figure 4, and the pseudocode is given in Algorithm 3. The model aims to extract and enhance semantic features from API call sequences and DLL information. First, the graph is constructed using API call sequences and DLL information, where nodes represent API calls or DLLs and edges represent interactions between them. Then, initial node embeddings are generated using Node2 Vec via random walks that understand structural relationships in the graph. The embeddings are enhanced using GAT by applying attention mechanisms to improve contextual relationships. Finally, the GAT-enhanced embeddings are fed into the CNN-GRU-3 model, which performs the final classification to detect malware.  
```
1:Input: Graph \(G=(V,E,W)\), Dimensions \(d\), Walks per node \(r\), Walk length \(l\), Context size \(k\), Return parameter \(p\), In-out parameter \(q\), Number of epochs \(n\)
2:Output: Predicted class labels \(\hat{y}\)
3:functionNode2 VecEmbedding(\(G,d,r,l,k,p,q\))
4:\(\pi\) = PreprocessModifiedWeights(\(G,p,q\))
5:\(G^{\prime}=(V,E,\pi)\)
6: Initialize \(walks\) as Empty
7:for\(iter=1\) to \(r\)do
8:for each node \(u\in V\)do
9:\(walk\) = Node2 VecWalk(\(G^{\prime}\), \(u\), \(l\))
10: Appendwalk to walks
11:endfor
12:endfor
13:\(f\) = StochasticGradientDescent(\(k\), \(d\), \(walks\))
14:return\(f\)
15:endfunction
16:functionGAT(\(f\), Adjacency Matrix \(A\), Attention Parameters \(W\), \(a\))
17: Initialize attention coefficients: \(e_{vu}\)
18: Normalize attention coefficients: \(a_{zu}\)
19: Update node embeddings: \(Z_{v}\)
20:return\(Z\)
21:endfunction
22:functionTrainCNNGRU3(\(Z\), \(Y\), \(n\))
23: Input \(Z\)
24: Pass \(Z\) through convolutional layers:
25: Conv1D: 64 filters, kernel size 3, activation ELU, then MaxPooling1D
26: Conv1D: 64 filters, kernel size 3, activation ELU, then MaxPooling1D
27: Conv1D: 64 filters, kernel size 3, activation ELU, then MaxPooling1D
28: Flatten the output of convolutional layers
29: Pass through GRU layers:
30: GRU1: 512 hidden units, dropout 0.3
31: GRU2: 256 hidden units, dropout 0.3
32: GRU3: 128 hidden units, dropout 0.3
33: Fully connected layers:
34: Dense1: 64 units, dropout 0.3, activation ReLU
35: Dense2: 1 unit, activation Sigmoid
36: Compile model with Adam optimizer, binary crossentropy loss
37: Train model for \(n\) epochs using \(Z\) and labels \(Y\)
38:return trained model and predictions \(\hat{y}\)
39:endfunction
```  
**Algorithm 3** Pseudocode for Node2 Vec + GAT + CNN-GRU-3 Training Pipeline  
GAT's attention mechanism improves Node2 Vec embeddings by weighting the information from each node's neighbors with attention coefficients (\(\alpha_{vu}\)) to make them more contextual. While Node2 Vec understands node relationships with random walks, these embeddings only carry structural information. GAT, on the other hand, provides semantic enrichment of embeddings by calculating the importance of nodes to their neighbors (\(e_{vu}\)). This process enables each node to create a more meaningful representation in its context. This contextual enrichment is evaluated with higher accuracy rates by DL classifiers. The effectiveness of the proposed model is evaluated through multiple experimental setups, where it is also compared with other graph embedding and classification techniques. The results show that the proposed Node2 Vec + GAT + CNN-GRU-3 model achieves the highest accuracy of 0.9961 and outperforms other tested configurations. This achievement is due to the combination of Node2 Vec's effective structural embedding, GAT's contextual enhancement of embeddings with an attention mechanism, and CNN-GRU-3's sequential modeling capabilities.