## 3 Theoretical Background
### Dataset  
The dataset, which was created using API Call and DLL sequences extracted from Windows PE files, initially consisted of 1000 benign and 1000 malicious software samples. In order to increase the performance of the dataset and provide a more robust evaluation, the amount of data for each category was increased to 4000 using the data augmentation method, as shown in Table 2. As a result of this process, a total of 8000 data samples (4000 benign and 4000 malicious) were obtained. This balanced dataset reduces bias during model training and increases model performance. The features and descriptions of the dataset are shown in Table 3. \begin{table}
\begin{tabular}{c c} \hline \hline
**Notations** & **Explanations** \\ \hline G & Graph \\ V & Node set \\ E & Edge set \\ \(u\) & Node \\ \(v\) & Neighbor of the node \\ \(y\) & Classifiers \\ \(W\) & Learnable weight matrix. \\ \([Wh_{v}\parallel Wh_{u}]\) & Weighted concatenation of feature vectors of nodes v and u. \\ L & Loss function \\ \(h_{u}\) & The feature vector of neighbor node u obtained using Node2 Vec \\  & or GraphSAGE. \\ \(h_{v}\) & The feature vector of node v obtained using Node2 Vec or GraphSAGE. \\ \(Z_{v}\) & New node representation by GAT. \\ \(\alpha\) & Learnable weight vector. \\ \(\alpha_{vu}\) & It shows the normalized influence of node u on node v. \\ \(N(v)\) & The neighbor set of node v. This includes the nodes to which v is directly connected. \\ \(e_{vu}\) & The attention coefficient between node v and its neighbor u. \\ P & Controls the probability of the walk to return to the previous node. \\ q & Determines the tendency of the walk to explore local neighborhoods or the wider area. \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Notations and explanations of the formulas. In our graph construction process, we integrate two distinct features extracted from each PE file: the sequence of API calls and the list of imported DLLs. Both API calls and DLLs are represented as nodes in a unified directed graph. Sequential API calls are connected with directed edges to understand the temporal execution flow. In addition, for every API call in the sequence, we establish directed edges pointing to all DLL nodes associated with the file. This way reflects potential dependencies or origins of the API calls, even in the absence of exact DLL-API pairings. Combining dynamic behavior (via API sequences) and static structural context (via DLL imports) into a single graph provides the model with a rich and comprehensive representation of each sample. This enables downstream models like GAT to learn behaviorally and contextually better relevant patterns for distinguishing between benign and malicious files. Different embedding techniques, such as Node2 Vec, GraphSAGE, and GAT, were used to represent the graph nodes. Feature selection was performed to identify the highly significant features that could improve the model's performance. For this purpose, features were ranked using SelectKBest and ANOVA (Analysis of Variance) F-value, and their significance was visualized. In Figure 3, feature names are shown on the x-axis, and significance scores are shown on the y-axis. For this purpose, features were ranked using the SelectKBest method and ANOVA F-value, and their significance was visualized. ANOVA F-value is a statistical method used to measure the discrimination power of each feature in a dataset on the target variable by calculating the ratio between the between-class variance and within-class variance. In this study, the SelectKBest method from Scikit Learn [44] was utilized to calculate each feature's ANOVA F-value [45]. Features were then sorted in descending order based on their F-values, and the top k features with the highest impact on the target variable were selected. This process enabled the model to perform better using fewer features, prioritizing those with the most contextual and meaningful information.