## 5 Limitations and Discussion  
This section outlines the key limitations of the proposed framework and discusses its practical implications, scalability, and areas for future improvement. To assess generaliz  
Figure 7: Training and validation performance comparison of graph-based DL malware detection models. ability, the performance of the proposed framework is evaluated on three separate datasets: MalBehavD-V1, APIMDS, and the custom-built PEMalware dataset. These datasets differ significantly in sample distribution, API behavior patterns, and dataset scale. As shown in Table 9, our framework achieved strong results on MalBehavD-V1 (97.05%) and PEMalware (99.61%) despite the high-class imbalance (23,080 malicious vs. 300 benign samples) and large-scale and showed competitive performance on and APIMDS (95.41%). The performance on APIMDS was slightly lower compared to other datasets. This can be attributed to several factors: (i) severe class imbalance in APIMDS (23,080 malicious vs. only 300 benign examples), complicating decision boundaries; (ii) the scale of the dataset, which may require deeper or more scalable architectures; and (iii) behavioral inhomogeneity of benign examples, which may lead to overfitting or limited generalization. All models were trained independently on each dataset using the same protocol: standard 80/20 train-test split and 5-fold cross-validation to ensure consistency and robustness. This approach allows for fair comparisons across datasets. Training was performed on a single NVIDIA L4 GPU for all experiments. Training durations were similar except for the APIMDS dataset, which took approximately 60 min longer due to the more significant number of examples. This increase is expected and acceptable in the context of real-world scalability. While Table 9 confirms that the proposed framework achieves high accuracy, evaluating these results beyond accuracy alone is important. Compared to state-of-the-art methods such as DawnGNN and MINES, our framework demonstrates comparable or slightly superior performance but has significant architectural differences. For example, DawnGNN uses pre-trained GNN layers and hand-crafted semantic features, which may reduce adaptability to unseen environments. In contrast, our method performs end-to-end feature learning via graph-based embeddings and a hybrid CNN-GRU design and offers greater flexibility across various API-DLL patterns. Despite including computationally intensive modules such as GAT and GRU, the framework remains efficient due to mini-batch training, gradient checkpointing, and early stopping optimizations. While our framework achieves high accuracy on all datasets, we acknowledge that real-world malware detection scenarios are inherently dynamic and more complex. To mitigate dataset-specific limitations, we designed the graph generation and feature extraction pipeline to be dataset-independent by relying on structural and contextual relationships between API calls and libraries rather than static properties or hard-coded signatures. The proposed framework integrates graph-based embedding (Node2 Vec), attention mechanisms (GAT), and sequential DL (CNN-GRU-3), which inevitably leads to a higher computational cost compared to traditional ML models. This increase is particularly notable in components such as GAT, due to multi-head attention over large node graphs, and GRU, due to sequential processing. Regarding computational overhead, traditional detection methods are highly efficient because they are rule-based, requiring minimal memory and processing power. ML models introduce moderate overhead, especially during training,