Windows Malware Detection via Enhanced Graph Representations with Node2 Vec and Graph Attention Network  
[PERSON]  
1 Department of Computer Engineering, Mersin University, 33343 Mersin, Turkajye; [EMAIL_ADDRESS] (M.A. ); [EMAIL_ADDRESS] (C.I.A.) Footnote 1: email: [EMAIL_ADDRESS]  
[PERSON]  
1 Department of Computer Engineering, Mersin University, 33343 Mersin, Turkajye; [EMAIL_ADDRESS] (M.A. ); [EMAIL_ADDRESS] (C.I.A.) [PERSON]  
1 Department of Computer Engineering, Mersin University, 33343 Mersin, Turkajye; [EMAIL_ADDRESS] (M.A. ); [EMAIL_ADDRESS] (C.I.A.) Footnote 2: email: {c  
using software behavioral features, such as API call sequences and DLL dependencies, to understand contextual relationships. On the other hand, dynamic analysis involves running the program in a secure environment and observing its behavior [5]. However, these methods require more computational resources. A key feature for malware detection is the Application Programming Interface (API) call sequences that define the program behaviors [6]. API calls cover important behaviors such as file operations, network access, and registry changes and often contain contextual patterns that are distinctive for malware. Recent studies have applied Machine Learning (ML) [7; 8; 9; 10] and Deep Learning (DL) [11; 12; 13; 14] approaches to analyze API call sequences for malware detection. While ML often overlooks semantic context, DL models offer improved accuracy by capturing complex patterns and structural dependencies, making them effective against advanced and increasingly sophisticated evasion techniques. DL also stands out for its success in modeling complex malware features such as API call sequences or structural dependencies. Examining the relationships between API call sequences and Dynamic Link Library (DLL) helps develop more comprehensive and effective detection techniques for malware behavior. For example, an API sequence like \"CreateWindow->ShowWindow->CreateFile\" may indicate a malicious behavior when analyzed in context, such as hiding a malware window and creating a malicious file on the system [3]. DLL and API call sequences provide semantic and contextual information crucial to accurate malware detection. Unlike frequency-based approaches, NLP-based (Natural Language Processing) methods can effectively understand these relationships by treating API calls and DLLs as sequential text-like data [15]. However, many existing models still overlook deeper semantic connections between API functions. Graph representation has been widely used in language processing research for many years. In recent years, it has also come to the fore in malware analysis [16]. Integrating API call sequences and DLL usage into a unified graph analysis framework provides a more holistic view of software behavior, enabling more sensitive and robust malware detection. Inspired by the above arguments, we propose a new framework to detect increasingly sophisticated Windows malware in this paper utilizing the semantic analysis of API call sequences and DLLs. Unlike previous works in the literature that focus on analyzing API calls or DLLs separately, our approach addresses the joint analysis of these two critical components. In this paper, we propose a new framework for malware detection that uses graph-based methodologies using API call sequences and DLLs to construct meaningful graph representations. In the proposed framework, the Node2 Vec algorithm generates initial embeddings (vector representations of nodes) in the graph. Node2 Vec's random walk approach provides a strong starting point for understanding the structural relationships of nodes. These initial embeddings are improved by GAT with attention coefficients and made more contextual by giving weight to the importance of information from neighboring nodes. To the best of our knowledge, this is the first application to integrate Node2 Vec embeddings with GAT for contextual enhancement in malware detection.