DSGCNN-DA: A Deep Stacked Graph Convolutional Neural Network with Dynamic Aggregation for Malware Behavioral Learning

Abstract

Malware remains a major threat to computer systems, posing serious risks to security and privacy by stealing sensitive data, disrupting services, and compromising system integrity. Traditional detection methods are often ineffective against rapidly evolving malware. In response, data-driven deep learning has emerged as a powerful alternative. Recent models have demonstrated promising performance in detecting malicious behavior by learning from these behavioral traces. Behavior-based detection represents a significant advancement in the fight against malware. This paper introduces a deep stacked Graph Convolutional Network (GCN) for effective malware behavioral analysis. The aggregation of multiple GCN layers and blocks results in dynamically performed Jumping Knowledge (JK) method, especially Long Short-Term Memory (LSTM). LSTM-based JK dynamically selects and weights the most informative GCN layers for each node to improve the model’s ability. Experimental results demonstrate the superior performance of our deep stacked Graph Convolutional Network with Dynamic Aggregation (DSGCN-DA) model, achieving an accuracy of 98.93% on the API-Call-Sequences dataset, outperforming the state-of-the-art approaches.