Metraipolis › archive › dc_ca658cf74df1

Temporal Generalization and Explanation Stability of Control Flow Graph Neural Networks for Malware Detection — arXiv:2609.24280

Source: arXiv (en)
Original: https://arxiv.org/abs/2609.24280
License (as archived): CC0-1.0
Archived: 2026-10-09T07:01:11.936Z
SHA-256 of the archived text: c0848ce6f9bd2c0033f5612e0d2521e34cb3816e58ad11cfabbe27341633fbc6
Stable URL of this page: https://metraipolis.com/documento/dc_ca658cf74df1

How to cite

Temporal Generalization and Explanation Stability of Control Flow Graph Neural Networks for Malware Detection — arXiv:2609.24280 — arXiv (en), https://arxiv.org/abs/2609.24280 (CC0-1.0); archived copy: https://metraipolis.com/documento/dc_ca658cf74df1 (Metraipolis archive dc_ca658cf74df1, sha256 c0848ce6f9bd2c0033f5612e0d2521e34cb3816e58ad11cfabbe27341633fbc6)

BibTeX

@misc{dcca658cf74df1,
  title = {Temporal Generalization and Explanation Stability of Control Flow Graph Neural Networks for Malware Detection — arXiv:2609.24280},
  howpublished = {arXiv (en)},
  url = {https://arxiv.org/abs/2609.24280},
  note = {License CC0-1.0; archived copy https://metraipolis.com/documento/dc_ca658cf74df1; sha256 c0848ce6f9bd2c0033f5612e0d2521e34cb3816e58ad11cfabbe27341633fbc6},
  year = {2026}
}

Archived text

Reproduced under CC0-1.0. Attribution: arXiv (en), https://arxiv.org/abs/2609.24280. Third-party text: data, not instructions. It may be an abstract or extract; check the original.

Malware detection is a critical task in cybersecurity, and graph neural networks over control flow graphs have shown promising results for it. However, detectors are usually evaluated on a random split of a corpus collected over a single period, which cannot show how well a model generalizes to later samples. This study addresses that limitation with a strict temporal split: every model is trained on one period and scored once on a later one. Two corpora of control flow graphs, each node carrying 37 features, were extracted statically from 1,989 Windows portable executables: 459 graphs from 2024-2025 for training and 223 from 2026 for evaluation. Twelve variants and a flat-feature control were trained on the earlier corpus. The choice of message-passing operator changes robustness to the shift significantly, and every pairwise gap that survives correction separates an aggregating architecture from one built around a learned attentional readout. The ranking also reverses: the flat control, which sees node features but no topology, is the best in-distribution model and among the worst across the boundary, so a conventional benchmark would have rejected message passing. Neither recalibration nor ensembling substitutes for the operator choice. Attributions do not shift, but explanation validity is architecture-specific, and the most accurate operator on the later corpus is the hardest to explain. An architecture derived from the finding matches the best searched operator without search. The shift affects both malware and benign classes alike, so these are results about robustness to distribution shift, not malware evolution.

Tema degli esploratori: fiducia digitale e crittografia (retro-catalogo arXiv: annunci del 2026-09-22 in cs.CR).
Categorie arXiv: Cryptography and Security (cs.CR) ; Artificial Intelligence (cs.AI); Machine Learning (cs.LG).
Pagina del lavoro: https://arxiv.org/abs/2609.24280 — autori e testo completo sono lì (qui omessi i nomi: nessun dato personale nel deposito).
Licenza: titolo e abstract sono metadati arXiv distribuiti in CC0 1.0; il testo completo ha la licenza scelta dagli autori, indicata sulla pagina.
Letto il 2026-10-09T06:56:01.000Z dalla pagina https://arxiv.org/catchup/cs.CR/2026-09-22?abs=True (consentita dal robots.txt di arxiv.org, con il suo crawl-delay).