MalHAPGNN: An Enhanced Call Graph-Based Malware Detection Framework Using Hierarchical Attention Pooling Graph Neural Network

Guo, Wenjie; Du, Wenbiao; Yang, Xiuqi; Xue, Jingfeng; Wang, Yong; Han, Weijie; Hu, Jingjing

doi:10.3390/s25020374

Open AccessArticle

MalHAPGNN: An Enhanced Call Graph-Based Malware Detection Framework Using Hierarchical Attention Pooling Graph Neural Network

by

Wenjie Guo

¹

,

Wenbiao Du

¹,

Xiuqi Yang

¹

,

Jingfeng Xue

¹,

Yong Wang

¹

,

Weijie Han

² and

Jingjing Hu

^1,*

¹

School of Computer Science and Technology, Beijing Institute of Technology, Beijing 100811, China

²

School of Space Information, Space Engineering University, Beijing 100084, China

^*

Author to whom correspondence should be addressed.

Sensors 2025, 25(2), 374; https://doi.org/10.3390/s25020374

Submission received: 18 December 2024 / Revised: 4 January 2025 / Accepted: 8 January 2025 / Published: 10 January 2025

(This article belongs to the Special Issue Security of IoT-Enabled Infrastructures in Smart Cities)

Download

Browse Figures

Review Reports Versions Notes

Abstract

While deep learning techniques have been extensively employed in malware detection, there is a notable challenge in effectively embedding malware features. Current neural network methods primarily capture superficial characteristics, lacking in-depth semantic exploration of functions and failing to preserve structural information at the file level. Motivated by the aforementioned challenges, this paper introduces MalHAPGNN, a novel framework for malware detection that leverages a hierarchical attention pooling graph neural network based on enhanced call graphs. Firstly, to ensure semantic richness, a Bidirectional Encoder Representations from Transformers-based (BERT) attribute-enhanced function embedding method is proposed for the extraction of node attributes in the function call graph. Subsequently, this work designs a hierarchical graph neural network that integrates attention mechanisms and pooling operations, complemented by function node sampling and structural learning strategies. This framework delivers a comprehensive profile of malicious code across semantic, syntactic, and structural dimensions. Extensive experiments conducted on the Kaggle and VirusShare datasets have demonstrated that the proposed framework outperforms other graph neural network (GNN)-based malware detection methods.

Keywords: malware detection; malware embedding; graph neural network; representation learning; graph pooling mechanism

Share and Cite

MDPI and ACS Style

Guo, W.; Du, W.; Yang, X.; Xue, J.; Wang, Y.; Han, W.; Hu, J. MalHAPGNN: An Enhanced Call Graph-Based Malware Detection Framework Using Hierarchical Attention Pooling Graph Neural Network. Sensors 2025, 25, 374. https://doi.org/10.3390/s25020374

AMA Style

Guo W, Du W, Yang X, Xue J, Wang Y, Han W, Hu J. MalHAPGNN: An Enhanced Call Graph-Based Malware Detection Framework Using Hierarchical Attention Pooling Graph Neural Network. Sensors. 2025; 25(2):374. https://doi.org/10.3390/s25020374

Chicago/Turabian Style

Guo, Wenjie, Wenbiao Du, Xiuqi Yang, Jingfeng Xue, Yong Wang, Weijie Han, and Jingjing Hu. 2025. "MalHAPGNN: An Enhanced Call Graph-Based Malware Detection Framework Using Hierarchical Attention Pooling Graph Neural Network" Sensors 25, no. 2: 374. https://doi.org/10.3390/s25020374

APA Style

Guo, W., Du, W., Yang, X., Xue, J., Wang, Y., Han, W., & Hu, J. (2025). MalHAPGNN: An Enhanced Call Graph-Based Malware Detection Framework Using Hierarchical Attention Pooling Graph Neural Network. Sensors, 25(2), 374. https://doi.org/10.3390/s25020374

Note that from the first issue of 2016, this journal uses article numbers instead of page numbers. See further details here.

Article Menu

MalHAPGNN: An Enhanced Call Graph-Based Malware Detection Framework Using Hierarchical Attention Pooling Graph Neural Network

Abstract

Share and Cite

Article Metrics

Article Access Statistics

Further Information

Guidelines

MDPI Initiatives

Follow MDPI