Advanced Threat Detection Using Structural Features and Graph Neural Networks for Malware Analysis

Malware enriched with polymorphism, and obfuscation, has surpassed traditional signature and heuristic-based detection approaches. Machine learning and deep learning methods such as Convolutional Neural Networks (CNNs), and Recurrent Neural Networks (RNNs) have enhanced malware classification performance by utilizing static and sequential input as features. Nevertheless, the effectiveness of these approaches is limited due to their inability to model structural dependencies, which are crucial for identifying threats. This study, we propose a malware detection framework utilizing Graph Neural Networks (GNNs) to identify structural relationships within malware samples. The structural elements among the malware samples are incorporated within nodes/ and edges that apply to nodes, thereby allowing us to extract behavioral semantics that were not captured in previous models. The framework is evaluated using the EMBER dataset, which has 2,381 static and dynamic malware features; features are selected using Chi-square tests. We analyse advanced GNNs: Graph Convolutional Networks (GCNs); and Graph Attention Networks (GATs). Our findings demonstrate that the GNN-based malware detection framework outperforms classical detection methods (e.g., SVM, Random Forest, CNN, and RNN) consistently across multiple instances. This study establishes GNNs as a scalable, interpretable, and accurate approach for next-generation malware detection, and as a method that is resilient to adversarial evasion and structurally aware of malware behaviors.