## 4 Proposed Approach and Experiments
### Results and Evaluation

Table 6: Performance comparison of using GAT as a standalone classifier and combining it with Node2 Vec/GraphSAGE. \begin{table}
\begin{tabular}{c c c c c c c} \hline \hline
**Model** & **Accuracy** & **F-Measure** & **Precision** & **Recall** & **MAE** &
\begin{tabular}{c} **Cohen’s** \\ **Kappa** \\ \end{tabular} \\ \hline Node2 Vec + GAT + CNN-GRU-3 & 0.9961 & 0.9955 & 0.9960 & 0.9961 & 0.0039 & 0.99 \\ Node2 Vec + GAT + Ensemble L. & 0.9871 & 0.9860 & 0.9875 & 0.9871 & 0.0129 & 0.97 \\ GraphSAGE + GAT + CNN-GRU-3 & 0.9898 & 0.9890 & 0.9885 & 0.9898 & 0.0102 & 0.98 \\ GraphSAGE + GAT + Ensemble L. & 0.9873 & 0.9865 & 0.9860 & 0.9873 & 0.0127 & 0.97 \\ \hline \hline \end{tabular}
\end{table} 
Table 7: Classification performances of Node2 Vec and GraphSAGE embeddings with CNN-GRU-3 and ensemble learning by improving with GAT. \begin{table}
\begin{tabular}{c c c c c c c} \hline \hline
**Model** & **Accuracy** & **F-Measure** & **Precision** & **Recall** & **MAE** &
\begin{tabular}{c} **Cohen’s** \\ **Kappa** \\ \end{tabular} \\ \hline GAT + CNN-GRU-3 & 0.9713 & 0.9700 & 0.9705 & 0.9713 & 0.0287 & 0.94 \\ GAT + Ensemble L. & 0.9677 & 0.9670 & 0.9665 & 0.9677 & 0.0323 & 0.93 \\ \hline \hline \end{tabular}
\end{table} 
Table 8: Using GAT as a feature extractor and comparing its classification performance with CNN-GRU-3/ensemble learning models. + CNN-GRU-3 model provided high performance with an accuracy of 0.9898 even when GraphSAGE was used instead of Node2 Vec. This configuration was not as successful as the Node2 Vec + GAT + CNN-GRU-3 configuration because Node2 Vec can better understand contextual information with the random walk method. As seen in Figure 5, the models' performance comparison reveals the proposed framework's superiority. The performance comparison of the models, as shown in Figure 5, highlights the superiority of the proposed framework. The confusion matrix of the three models that achieved the highest accuracy is given in Figure 6.  
The proposed Node2 Vec + GAT + CNN-GRU-3 model achieved a highly balanced classification, with only 3 false positives and 3 false negatives out of 1600 test samples. In contrast, the GraphSAGE + GAT + CNN-GRU-3 configuration resulted in slightly more errors (8 false negatives and 9 false positives), while the GraphSAGE + GAT + Ensemble Learning model showed the highest number of misclassifications (10 false negatives and 11 false positives). The proposed Node2 Vec + GAT + CNN-GRU-3 model achieved the highest accuracy (0.9961) in all experiments. This proves the effectiveness of the model's integration of graph-based contextual information and DL. Recall and F-measure values were higher in the experiments where GAT was used as an embedding improvement method. This is because GAT optimizes contextual relationships and reveals meaningful relationships between nodes. The MAE value of the proposed model (0.02%) is lower than other models. This shows that the model's error rate in malware detection is relatively low. The Node2 Vec + GAT + CNN-GRU-3 model obtained a high value of 0.98 with Cohen's Kappa. This supports the classification stability and overall accuracy of the model. Considering Experiment 1, it was observed that the accuracy and recall rates were lower in these experiments where Node2 Vec and GraphSAGE embeddings were used without improvement with GAT. In particular, the generalization success of the GraphSAGE + Ensemble model was limited. When Experiment 2 was evaluated, contextual information extraction increased in these experiments, where GAT was used as a classifier. However, since the initial embeddings were not directly improved, the accuracy rates were lower compared to the embedding improvement method. When Experiments 3 and 4 were evaluated, the model's accuracy and generalization success increased significantly in  
Figure 5: Performance comparison of malware detection models. Figure 6: Confusion matrices of the three best-performing models. the experiments where GAT was used as the embedding improvement method.