Learning Joint Embeddings of Function and Process Call Graphs for Malware Detection

2025-10-10

AI Summary

Existing malware detection methods predominantly rely on a single graph representation—such as a Function Call Graph (FCG) or a Process Communication Graph (PCG)—overlooking their complementary strengths. To address this limitation, we propose GeminiNet, the first dual-view graph neural network that jointly models FCGs and PCGs. GeminiNet statically extracts FCGs using Ghidra and dynamically captures PCGs via the Any.Run sandbox, then employs a two-branch Graph Convolutional Network (GCN) architecture augmented with an adaptive gating mechanism to dynamically fuse representations from both graphs. Experimental evaluation on 635 Windows malware samples demonstrates that GeminiNet’s joint embedding significantly outperforms single-graph baselines, achieving substantial gains in detection accuracy. This work constitutes the first systematic exploration of synergistic static–dynamic graph modeling for malware analysis, establishing a novel paradigm for fine-grained malicious behavior identification.

Technology Category

• Machine Learning: Graph-based Machine Learning
• Data Mining & Knowledge Management: Graph Mining, Social Network Analysis & Community
• Reasoning under Uncertainty: Graphical Models

Application Category

• Graph Algorithms and Modeling for the Web: Graph neural networks and deep learning approaches for Web-related graphs
• Web Mining and Content Analysis: Web data integration and cleaning
• Semantics and Knowledge: Methods to enhance, augment, integrate or synergize semantic models such as knowledge graphs and LLMs

Abstract

Software systems can be represented as graphs, capturing dependencies among functions and processes. An interesting aspect of software systems is that they can be represented as different types of graphs, depending on the extraction goals and priorities. For example, function calls within the software can be captured to create function call graphs, which highlight the relationships between functions and their dependencies. Alternatively, the processes spawned by the software can be modeled to generate process interaction graphs, which focus on runtime behavior and inter-process communication. While these graph representations are related, each captures a distinct perspective of the system, providing complementary insights into its structure and operation. While previous studies have leveraged graph neural networks (GNNs) to analyze software behaviors, most of this work has focused on a single type of graph representation. The joint modeling of both function call graphs and process interaction graphs remains largely underexplored, leaving opportunities for deeper, multi-perspective analysis of software systems. This paper presents a pipeline for constructing and training Function Call Graphs (FCGs) and Process Call Graphs (PCGs) and learning joint embeddings. We demonstrate that joint embeddings outperform a single-graph model. In this paper, we propose GeminiNet, a unified neural network approach that learns joint embeddings from both FCGs and PCGs. We construct a new dataset of 635 Windows executables (318 malicious and 317 benign), extracting FCGs via Ghidra and PCGs via Any.Run sandbox. GeminiNet employs dual graph convolutional branches with an adaptive gating mechanism that balances contributions from static and dynamic views.

Problem

• Learning joint embeddings from function and process call graphs
• Improving malware detection through multi-perspective software analysis
• Addressing limitations of single-graph models with unified neural approach

Innovation

• Learning joint embeddings from function and process graphs
• Using dual graph convolutional branches with adaptive gating
• Combining static analysis with dynamic runtime behavior