## 4 Proposed Approach and Experiments  
This section presents the proposed malware detection framework in a formalized structure, followed by four distinct experimental configurations designed to evaluate the contribution and interaction of its core components. Before a detailed analysis of the experiments, we outline the structural relationship between the experimental setups and the proposed framework. The experiments were designed as follows: (i) graph-based node embedding, achieved through Node2 Vec or GraphSAGE to understand topological and semantic features from API and DLL graphs; (ii) contextual refinement of embeddings through the GAT, which assigns importance weights to neighboring nodes using attention coefficients; and (iii) final classification using either a custom hybrid CNN-GRU-3 model, optimized for sequential pattern recognition, or an ensemble of traditional ML classifiers. The experiments were designed as follows:  
* Experiment 1: to assess their baseline performance, Node2 Vec and GraphSAGE embeddings were paired with CNN-GRU-3 and ensemble learning models.
* Experiment 2: GAT was used as a standalone classifier, and its effectiveness was compared with the combinations Node2 Vec + GAT and GraphSAGE + GAT.
* Experiment 3: Node2 Vec and GraphSAGE embeddings were refined by GAT, and enhanced embeddings were evaluated using CNN-GRU-3 and ensemble learning.
* Experiment 4: GAT was used solely as a feature extractor, and the resulting embeddings were classified using CNN-GRU-3 and ensemble learning.  
Each of the four experiments explores different configurations of these components to assess their individual and combined contributions. Specifically, Experiment 1 evaluates the baseline performance of Node2 Vec and GraphSAGE embeddings using CNN-GRU-3 and ensemble classifiers without GAT. Experiment 2 measures the standalone classification  
Figure 3: Feature importance based on ANOVA F-value.  
capability of GAT and its integration with initial embeddings. Experiment 3 corresponds to the proposed framework, where GAT refines the embeddings, and CNN-GRU-3 performs classification. Experiment 4 analyzes GAT solely as a feature extractor prior to classification. This experimental design allows for a modular and comparative evaluation of each architectural component and demonstrates how their integration leads to the performance gains achieved by the whole framework.  
Experiment 1: Graph Embedding with Node2 Vec and GraphSage Embedding--Comparison of Graph Node Embeddings  
In Experiment 1, node embeddings obtained using Node2 Vec and GraphSAGE are paired with CNN-GRU-3 and ensemble learning models to evaluate their baseline performance. This experiment aims to perform a baseline performance evaluation by comparing the contribution of both embedding methods to the classification process. For each node \(v\), an embedding is created using Node2 Vec or GraphSAGE:  
\[h_{v}=\text{Node2 Vec}(v)\quad\text{or}\quad h_{v}=\text{GraphSAGE}(v) \tag{11}\]  
These embeddings are used as a vector representation of each node in low-dimensional space. Embeddings are given as input to CNN-GRU-3 and ensemble learning models. These classifiers perform malware detection using node representatives.  
\[y=f(h_{v}),\quad f\in\{\text{CNN-GRU-3, Ensemble L.}\} \tag{12}\]