arXiv:2606.06815v1 [cs.CR] 5 Jun 2026
AMD-FCG: An Enhanced Function Call Graph Dataset with Integrated Topological Features for Malware Detection and Classification Parthajit Borah1*, Sakshi Singh1† , D.K. Bhattacharyya2 and J.K. Kalita3 School of Cyber Security and Digital Forensics, National Forensic Sciences University,Guwahati. 2 Department of Computer Science and Engineering, Tezpur University, Tezpur, 784028, Assam, India. 3 Computer Science, College of Engineering and Applied Science, University of Colorado,Colorado Springs, CO 80933-7150, Colorado, USA. 1*
*Corresponding author(s). E-mail(s): [email protected]; † These authors contributed equally to this work. Abstract As malware illustrates a complex structure and behavior, detection of these has been a significant challenge in the domain of cybersecurity along with related services in daily life. So, it becomes crucial to have a reliable and adaptive solution to address the issue. Among the several detection methods developed over the years, one of the most reliable ones is studying and analyzing the structural and behavioral patterns of malware. These patterns of sophisticated malware can be obtained with the help of Function Call Graphs (FCGs). However, to effectively cover numerous groups of families of malware, it is required to have a sufficiently large dataset for the system to operate on. In order to ensure accuracy and robustness of the system, the dataset should comprise samples of different malwares and a benign application for secure execution of the detection process. This paper introduces AMD-FCG, an enhanced Function Call Graph
1
2
AMD-FCG dataset integrated with topological features of malwares. The framework enhances the detection procedure, streamlining the workflow for cybersecurity professionals and also eliminating the need for dynamic analysis and extensive processing. Therefore, it can be used to develop and deploy more efficient and innovative malware detection systems. Keywords: Malware, Entropy, function, Static, Dynamic, Android
1 Introduction The world is witnessing a digital revolution and a rapid shift in technologies every day. With these advancements–data, services, and systems became essential for the efficient workflow of all domains. However, these factors continuously face significant threats from malware and malware-based attacks. As malware carries ever-evolving sophistication along with complex and advanced methodologies to circumvent security measures, it becomes essential to regard this as an intricate problem and craft robust security mechanisms. The primary agenda behind malware-based attacks is to damage data, compromise information, disrupt services, and in some cases gain unauthorized access to critical systems. Modern cyberthreats encompass a wide range from traditional viruses and worms to advanced and adaptive malware such as ransomware and spyware. [1] [2] Malware-based attacks are carried out with the intent to conduct unauthorized activities like data theft, operational disruptions, and espionage, leading to significant financial losses and reputational damage. The modern threat actors adopt advanced techniques such as code obfuscation, packing, and encryption to evade traditional detection systems. [3] [4]. These techniques conceal the true nature, dynamics, and functionality of malware, thereby complicating the identification of malicious software. Therefore, defense mechanisms designed to counter these sophisticated attacks must demonstrate strong resilience while simultaneously possessing the ability to accurately detect even the most intelligently disguised malware. In general practice, advanced security systems actively combine static and dynamic analysis, where the principle behind dynamic is executing the code in a controlled environment, and static analysis involves examining the code, structure, and properties of software typically without execution. [5] [6] The analysis process reveals intricate patterns and signatures associated with the malware, which play a significant role in its detection. However, static analysis techniques can be compromised by code obfuscation mechanisms; hence, dynamic analysis is essential for thorough observation of malicious software. [4]. Even though such analysis techniques are effective, there are several technical snags. Firstly, dynamic analysis techniques are resource intensive, and for accurate interpretation of malicious behaviors, it requires extensive feature engineering. Secondly and most importantly, such techniques can be bypassed by malware which has the ability to
AMD-FCG
3
detect virtualized environments. To overcome these challenges, advanced malware data representation techniques are the need of the hour. These novel techniques help in the creation of an efficient and more compact structural representation of malware behavior. Such representations facilitate quicker processing and reduce the need of extensive feature engineering. Subsequently, malware analysis using such representations is more effective and is less time consuming. This aids in the development of accurate and adaptive defense systems enabling real-time threat detection and response. Additionally, such systems are also robust in nature against rapidly evolving malware variants, significantly improving overall cybersecurity. Recent upsurge in malware attacks have dramatically given rise to grave threats worldwide. These threats are not confined to one geographical boundary alone and may be effortlessly launched from one faraway region to another. Unsuspecting users of vulnerable and insecure systems end up being victims as malicious software are delivered to the platforms uncannily through various means.
1.1 Contribution The primary goal of this paper is to report the development of an enhanced malware dataset, named AMD-FCG, which integrates both Function Call Graph (FCG) data and topological features for advanced malware detection and classification. AMD-FCG produces a detailed and distinct dataset with the help of various static analysis techniques. These datasets further consist of 30,000 instances, each with 51 distinguishing classes of malware. Here, the 50 classes contribute to the classification of diverse variants of malware, whereas one class is specified for goodware. In addition, the FCG data features the structural relationships along with operative interactions between function calls inside the malicious program. This interactive record inherits information about commands and system/API functions executed to establish the malicious intent, which provides a unique view of malware behavior. The integrated topological characteristics strengthen the analysis procedure by quantifying the structural properties of graphs, which is critical for classifying different malware families. Furthermore, we release AMD-FCG under a CC-BY license, allowing researchers and practitioners to freely share and adapt the dataset to their specific needs. This open approach promotes collaboration and encourages innovative minds for the development of more effective malware detection techniques within the cybersecurity domain. Researchers interested in accessing this dataset for further studies can request it by emailing the corresponding author at [email protected].
1.2 Motivation With the advent of modern technology, the internet and the interconnected systems have essentially become an integral part of every industry. As many services and solutions are conveniently being brought to our doorstep so are
4
AMD-FCG
the serious security challenges that come with it. Malware and malware-based attacks pose a grave threat to the users of vulnerable and insecure systems. Sophisticated malware attacks are not only hard to recognize but also are more challenging to detect with traditional security measures. Due to the constant emergence of such attacks, effective and resilient detection mechanisms are the need of the hour. A key factor in designing such mechanisms is the quality of the data used for training and testing purposes. Especially, the data should be able to portray varied and complex real world attack scenarios. Lack of such quality datasets may lead to unwanted gaps in the security provided by the detection mechanisms. The prime focus of this article is to highlight the importance of this issue by introducing a new, improved dataset designed to enhance the efficacy of malware detection systems, helping to better protect against malware threats.
1.3 Organisation of the paper The organization of the paper is as follows. In Section 2, the background and state-of-the-art methods are discussed in length. Section 3 on the other hand presents the methodology used to develop AMD-FCG starting from the data collection process, call graph analysis, and topological feature extraction. Section 4 illustrates the results and experimentation using AMD-FCG. Lastly, we wind up with the overall concluding remarks in Section 5.
2 Background and State of the Art Malware is a malicious program coded in such a way that it damages data, computer systems, and networks as well. These malicious software are developed by attackers to steal sensitive information and access critical systems without the permission of the system’s owner. [1] [2]. Malware is emerging as a complex problem and is causing immense damage to various networks as well as the internet. They are in various forms and structures, such as Adware, Trojans, Backdoors, Worms, Bots, Rootkits, Downloaders, Ransomware, and Viruses [7] [8]. Malware-based attacks are diverse; some attacks are straightforward with a single stage, while others are intricate and multi-staged with various malware as entities to accomplish the malicious goals. In addition, complexity and sophistication update the malicious program to a large extent, strengthening malware to trick detection systems. Simple attacks hold a single piece of malicious code to breach systems and steal information, whereas advance attacks inherit a complex code structure along with intelligently ordered steps to fulfill the hidden agenda. In order to counter these attack vectors, it is important to examine the behavior of malware through a detailed analysis. This can be done by accumulating and uncovering the risk factor and the intended target of the malware. Malware analysis plays a crucial role in recognizing indicators of compromises, as they are further used to train and develop detection models. [9]. The four core techniques in malware analysis are static, dynamic, automated,
AMD-FCG
5
and manual code reversing. [4]. Each technique provides strong characteristics with a unique view of malware, leading to a better understanding and reduction in the impact of malware threats. The representation of malware data plays an important role in strengthening defense systems to battle against various malware and malware-based attacks. Apart from just boosting the process of malware detection, it also counters the impact of the unauthorized access. There are various formats to represent the malware data; each format is crafted to deal with specific aspects of threat analysis, and improving the security mechanisms. These formats serve as essential input data for malware defense models. Typically, malware data can be categorized into several distinct types: tabular data, image data, graph data, sequence data, and text data. From the mentioned approaches, one of the most reliable ones is examining the structural patterns of malware, and these patterns are captured with the help of function call graphs (FCGs). FCGs give a detailed mapping of all the interactions that occurred between the functions inside the program. This provides a rich collection of information that is crucial in identifying malicious activity. While FCGs are fundamental for revealing these behavioural patterns, they often lack in providing additional contextual information that strengthens the distinguishing ability of the graph. However, this gap can be filled by combining topological features of malware, which gives a broader set of characteristics of the graph, and thus enhancing the overall robustness of malware detection. There are a limited number of publicly available function call graph datasets of malware. And from the very few, only one dataset is currently accessible, and that is MalNet [10]. These datasets often contain only the function call graphs, where the functions are denoted by numerical identifiers instead of their actual names, which is a bottleneck for data interpretability. In general, they also lack integration of the topological features, which is required to obtain broader structural characteristics of the graph. This bounds the richness of analysis and the scope development of more advanced detection models.
3 Methods This section covers multiple processes involved in the generation of AMDFCG’s integrated dataset. At first, the Function Call Graphs (FCGs) are produced, and then the topological features are extracted from these graphs. The development of AMD-FCG includes a sequence of comprehensive and rigorous processes, which ensures accurate generation of FCGs and accumulation of meaningful topological features. The proposed framework of AMD-FCG, illustrated in Figure 1, shows the overall process from dataset creation to validation. The framework contains various processes such as data collection, feature extraction and integration, and model validation.
6
AMD-FCG Sandbox FCG
NetworkX
Call Graph
DEX Validation Decompile
Data Peprocessing
Malware/Benign Applications
Collected Data
Virtual Network
Training
Learning algorithms
Host Machine
Call Graphs
Malware
Trained Model Goodware
Unknown Data
Fig. 1 AMD-FCG Generation and Evaluation Framework
3.1 Data Collection We collected 10,000 benign Android apps from Google Play Store and AndroZoo as goodware. Moreover, we gathered a total of 20,000 raw Android malware files classifying 50 malware families from [11] [12] for malware binaries to obtain a comprehensive and extensive data archive. The extracted Android applications are saved in a database server for further processing and analysis. The rich collection of data is used to create Function Call Graphs (FCGs) and gather topological features, which is a crucial step towards better malware detection and classification for the AMD-FCG dataset.
3.2 Function Call Graph Extraction A series of methodical steps are involved in extracting and analyzing the function calls from Android applications. These steps involve the process of decompilation, analysis, and representation of the application’s internal structure in the form of a function call graph. The following outlines the process in detail.
AMD-FCG
7
3.2.1 APK analysis The first step is to decompile the Android binaries using the reverse engineering tool Androguard1 . With the help of Androguard, the DEX (Dalvik Executable) files, which contain the compiled code of the Android application, are extracted and parsed to extract the Dalvik bytecode. Dalvik bytecode, a register-based instruction set used by the Android Runtime (ART) or Dalvik Virtual Machine, is then analyzed to understand each instruction’s purpose and potential impact on the program flow. Additionally, the AndroidManifest.xml file is analyzed to gain insights into the app’s structure, permissions, and components.
3.2.2 Methods Extraction Following the analysis of the Dalvik bytecode, the next step involves finding and organizing all the functions or methods used within the application. This includes methods written by the app’s developers, as well as those provided by the Android system, which allows the app to interact with different features of the device, such as the user interface, data storage, or hardware features like the camera or GPS. It also includes methods from any third-party libraries the app uses. All these methods give us a clear understanding of how the app works and how it interacts with the Android system and other software libraries.
3.2.3 Control Flow Analysis In this stage, the process of analyzing the bytecode of each method to discover the flow of interaction between the methods is introduced. It is accomplished by various types of method calls like direct, virtual, interface, and super method calls. The relationship between the calling method (caller) and the method being called (callee) is systematically recorded for each method invocation. Besides just tracing these method calls we also analyze the flow of control inside each method with an eye towards understanding conditional branches, loops, and exception handling. This method gives a detailed view of the execution paths in the application, which helps in understanding how the app works or behaves.
3.2.4 Graph Construction The relations between the methods are used to build a directed graph . Each node of the graph is a method and each edge of the graph is a method call or control flow between methods. The graph is stored as an adjacency list for efficient storage and traversal. The numeric identifiers are used instead of the actual method names to protect the sensitive information. This results in a translation mapping between the original method identifiers and the masked 1
https://androguard.readthedocs.io/en/latest/intro/index.html
8
AMD-FCG
Table 1 Snapshot of Function Call Graph (FCG) for Airpush Malware Source Function HttpPostDataTask.<init> (Context, List, String, Listener) HttpPostDataTask.<init> (Context, List, String, Listener) HttpPostDataTask.<init> (Context, List, String, Listener) Airpush$3.onTaskComplete(String)
Target Function Util.printDebugLog(String) AsyncTask.<init>() StringBuilder.toString() AsyncTaskCompleteListener .lauchNewHttpTask()
Description Constructor of HttpPostDataTask calls the static method printDebugLog in the Util class. Constructor of HttpPostDataTask calls the constructor of AsyncTask from Android OS. HttpPostDataTask constructor includes a call to StringBuilder’s toString method. onTaskComplete method in Airpush$3 calls launchNewHttpTask in AsyncTaskCompleteListener.
ones. This step guarantees that sensitive method names are protected and it still allows comprehensive study of structure and behavior of the application.
3.2.5 Visualization The final step is to visualize the call graph using Graphviz. This visualization gives a graphical representation of the abstract data and provides a whole view of the application structure. It reduces complex relationships to an easy to understand visual map. It gives a better view of the interaction and collaboration of different parts of the application. Algorithm 1: Process APKs and Generate Call Graphs Input: list_of_apks Output: list_of_call_graphs forall apk in list_of_apks do a, d, dx ← AnalyzeAPK(apk); call_graph ← dx.get_call_graph(); node_to_number ← Encode each function name in call_graph to a unique number; numbered_graph ← label call_graph using node_to_number; return (numbered_graph, call_graph); end Table 1 displays the snapshot of the Function Call Graph of Airpush malware, including the source and target functions along with descriptions of the calls.
3.3 Importance of Topological Features in Malware Detection Function Call Graphs (FCGs) topological features are robust tools to identify malware since they encode the structural and behavioral features of software even when malware authors attempt to hide their intentions using obfuscation techniques [13] [14]. Some features such as Betti numbers, homology groups and the Euler characteristic can be used to identify important properties of the graph such as how functions are connected, if there are loops and how complex the graph is [15]. These features are especially useful in malware detection as they are not influenced by tricks such as renaming functions, inserting useless code or changing control flow. Betti numbers can uncover patterns such as
AMD-FCG
9
loops, which are frequently used in encryption routines or repetitive malicious behaviors (see [16]).
3.4 Topological Feature Extraction Topological analysis involves a systematic approach to uncovering and understanding the shape and structure of data. Various topological features are extracted, providing insights into the data’s underlying patterns and properties. Below, we explore these topological features in detail. 1. Simplices A simplex is the simplest type of geometric object that can exist in any given dimension. It generalizes the concept of points, line segments, and triangles to higher dimensions [17] [18]. • 0-simplex: A point. • 1-simplex: A line segment, formed by connecting two points. • 2-simplex: A triangle, formed by connecting three non-collinear points. Mathematically, a k-simplex is defined as: ( k X σ = x ∈ Rd : x = ti pi , (1) i=0
where
k X
) ti = 1, and ti ≥ 0 for all i
i=0
where p0 , p1 , . . . , pk are the vertices of the simplex, and ti are the barycentric coordinates. A simplicial complex represents all the connections (edges) between nodes in a call graph. • Nodes (functions, methods, or procedures in the call graph) are represented as 0-simplices. • Edges (calls between these nodes) are represented as 1-simplices. • If three or more nodes are fully interconnected (i.e., each node is connected to every other node), this relationship can be represented by a 2-simplex (a triangle) or higher-dimensional simplices for more complex connections. 2. Betti Numbers Betti numbers βk are topological invariants used to describe the kdimensional features of a topological space. Specifically, β0 counts the number of connected components, β1 counts the number of independent loops, and β2 counts the number of cavities or voids [19] [18]. Mathematically, the k-th Betti number is defined as: βk = dim(Zk ) − dim(Bk )
(2)
where Zk is the space of k-cycles and Bk is the space of k-boundaries. For example in Figure 2:
10
AMD-FCG
P1
P2
P1
P1
P2
P3
Fig. 2 Examples of simplices of dimensions 0, 1, and 2
• β0 (Connected Components): β0 = 1 The simplicial complex has only one connected component, as all vertices (P1 , P2 , and P3 ) are part of the same structure. • β1 (Loops or Cycles): β1 = 1 There is one loop (the triangle formed by p1 , p2 , and p3 ) present in the complex. • β2 (Voids): β2 = 0 The complex does not contain any 2-dimensional voids 3. Euler characteristic The Euler characteristic is a fundamental topological invariant that provides a single number summarizing the shape or structure of a simplicial complex [20]. For a call graph, it is calculated as: χ=V −E+F (3) where V is the number of vertices (0-simplices), E is the number of edges (1-simplices), and F is the number of filled triangles (2-simplices). This invariant gives an overview of the graph’s topological complexity. 4. Persistence Features Persistence features are key metrics in topological data analysis that provide insight into the structure and distribution of topological features within a persistence diagram [21]. • Persistence Entropy Persistence entropy E(D) measures the unpredictability or complexity of the features’ lifetimes in a persistence diagram. It is defined as: X E(D) = − pi log(pi ) (4) i∈I
AMD-FCG where pi =
di − bi , LD
and LD =
X
11
(di − bi )
i∈I
with bi and di representing the birth and death times of features, respectively. • Mean Persistence Mean persistence µ(D) represents the average lifespan of the features in the persistence diagram, calculated as: µ(D) =
1X (di − bi ) I
(5)
i∈I
where I is the total number of features, and bi and di are their birth and death times. 5. Morse Analysis Morse analysis is a mathematical method used to study the topology of manifolds by examining the critical points of a smooth function on the manifold. For a graph G, Morse analysis identifies and categorizes critical points based on their local neighborhoods [22] [23]. maximum minimum Critical Point Category = saddle isolated
if deg(v) > deg(u) for all u ∈ N (v) if deg(v) < deg(u) for all u ∈ N (v) if deg(v) has both neighbors with higher and lower degree if deg(v) = 0 (6) Here, deg(v) represents the degree of vertex v and N (v) is the set of neighbors of v. By analyzing the critical points, the topological features of the graph are extracted, which will help in understanding its structure and characteristics. 6. Homology and Cohomology Homology is a concept in algebraic topology that studies the topological features of a space, such as connected components, holes, and voids [24] [18]. For a simplicial complex K, the n-th homology group Hn (K) is defined as: Zn (K) Hn (K) = (7) Bn (K) where Zn (K) is the group of n-cycles (chains with no boundary) and Bn (K) is the group of n-boundaries (boundaries of (n+1)-chains). Cohomology is a dual concept to homology and provides an algebraic structure that encodes the information of the space. For a simplicial complex K, the n-th cohomology group H n (K) is given by: H n (K) = Hom(Hn (K), Z)
12
AMD-FCG
This group consists of homomorphisms from the n-th homology group to the integers Z, capturing the dual structure of the homology. 7. Reeb Graph The Reeb graph size feature is defined as the number of nodes in the largest connected component of the Reeb graph, which captures the evolution of level sets of a continuous function on a graph. It provides a simplified representation of the topology of the graph [25]. Reeb_Graph_Size(G) = max {Connected_Components}(G, f)
(8)
where G is the graph and f is a continuous function defined on G. Algorithm 2: Extract Features from FCGs Input: List of FCGs G Output: Feature vector for each FCG foreach g ∈ G do e ← read_graph(g); v0 ← count_nodes(e); v1 ← count_edges(e); v2 ← count_triangles(e); b0 , b1 ← calculate_betti_numbers(e); ec ← calculate_euler_characteristic(v0 , v1 , v2 ); st ← generate_vietoris_rips(e); pe, mp ← calculate_persistence(st); hg ← calculate_homology_groups(st); coh ← calculate_co_homology(st); mt ← calculate_morse_features(e); rg ← calculate_reeb_graph(e); return {v0 , v1 , v2 , b0 , b1 , ec, pe, mp, hg, coh, mt, rg}
4 Experiments and Results All experiments has been implemented in Python using a Dell Precision 7810 workstation with 2x Intel Xeon (R) W-2145 comprising 8 cores, 64GB RAM, NVIDIA RTX 4090 GPU with 24GB VRAM, and Ubuntu OS. Materials used, preprocessing carried out, and performance achieved are discussed next.
4.1 Dataset Characteristics The AMD-FCG dataset consists of 30,000 instances of malware and goodware samples. It comprises 20,000 malware instances, and 10,000 goodware instances. The dataset is categorised into 51 distinct classes, with 50 classes dedicated to various types of malware and one class for goodware. The detailed dataset statistics are presented in Table 2. To provide a visual representation of the data distribution, Figure 4 illustrates the overall class distribution,
AMD-FCG
13
while Figure 5 shows the top 10 categories within the dataset. The figure 3 illustrates the directory structure, showcasing how the AMD-FCG dataset is organized. Table 2 Dataset Statistics Characteristic Total Instances Malware Instances Goodware Instances Total Classes Malware Classes Goodware Class
Count 30,000 20,000 10,000 51 50 1
Fig. 3 Directory structure of AMD-FCG
4.2 Performance Evaluation For performance evaluation, we considered five Graph Neural Network (GNN) models—GCN, GraphSAGE, GIN, GAT, and GraphConv—and observed their performance on the Function Call Graph (FCG) dataset. The results of these models on the FCG dataset are reported in Table 3. On the FCG dataset, GIN achieved the highest accuracy of 77.1%, while GraphSAGE and GCN showed slightly lower performances with accuracies of 75.2% and 73.5%, respectively. GAT and GraphConv attained accuracies of 70.8% and 72.0%, respectively, on the same dataset. We used traditional machine learning models to evaluate the potential of our dataset for malware classification based on topological features. We
14
AMD-FCG
Fig. 4 Class Distribution of AMD-FCG
chose these models because they have been proven to be effective in handling complex data and capturing the important patterns that differentiate various types of malware. To make sure the assessment is exhaustive and impartial, we have adopted a strategic data partitioning scheme. The dataset was divided into three separate subsets, 70% was used to train the models, 10% was used for validation to fine-tune the models and the remaining 20% was used to test the final performance. We use these classical machine learning methods on our well-partitioned data set of topological features and try to set a benchmark for malware classification performance. For performance evaluation, we considered five traditional machine learning models—Random Forest, Support Vector Machine, Gradient Boosting, K-Nearest Neighbors, and Logistic Regression on the topological feature
AMD-FCG
15
Fig. 5 Top 10 categories of AMD-FCG
Table 3 Performance of GNN Models on FCG Dataset Model GCN GraphSAGE GIN GAT GraphConv
Accuracy (%) 73.5 75.2 77.1 70.8 72.0
Precision(%) 72.8 74.5 76.4 70.2 71.3
Recall(%) 74.0 75.7 77.5 71.1 72.5
F1-Score (%) 73.4 75.1 76.9 70.6 71.9
dataset. The results of these models on the topological dataset are reported in Table 4. In contrast, when evaluating the topological feature dataset, the traditional machine learning models generally achieved higher accuracy metrics. Gradient Boosting led with an accuracy of 85.0%, followed by Support Vector Machine and Random Forest, with accuracies of 84.1% and 83.2%, respectively. K-Nearest Neighbors and Logistic Regression showed competitive results, with accuracies of 79.8% and 81.0%, respectively. These results indicate that while GNN models like GIN perform well on graph-structured data such as FCG, traditional machine learning models generally excel on structured datasets with topological features. Gradient Boosting had the highest overall performance on the topological feature dataset, while GIN performed best on the FCG dataset.
16
AMD-FCG
Table 4 Performance of Machine Learning Models on Topological Feature Dataset Model Random Forest Support Vector Machine Gradient Boosting K-Nearest Neighbors Logistic Regression
Accuracy (%) 83.2 84.1 85.0 79.8 81.0
Precision(%) 82.9 83.8 84.7 79.5 80.7
Recall(%) 83.4 84.3 85.2 80.0 81.2
F1-Score (%) 83.1 84.0 84.9 79.7 80.9
4.3 Limitations and Challenges One of the main limitations of the datasets used for malware classification, the Function Call Graph (FCG) dataset and the topological feature dataset, is the problem of class imbalance. This is especially true for the underrepresentation of certain malware classes, which poses difficulties for model training and evaluation. These classes are hard to get enough samples of as they are rare classes and are not easily available in public databases. Augmentation techniques can be used to balance classes in traditional image datasets. However, augmentation of graph-based or topological feature data is not straightforward. Augmentation to artificially increase the number of samples may introduce artifacts or distortions that do not accurately reflect the true structural or behavioral characteristics of the original malware. For FCG dataset, it is important to keep the original distribution even if it is imbalanced, in order to keep the authenticity and integrity of the malware’s functional behavior. Any augmentation on graph structures may result in inaccurate representations of the malware’s execution flow, which could mislead the GNN models during training and evaluation. Similarly, for the topological feature dataset, adding synthetic samples can interfere with the topological patterns needed for accurate classification. Instead, we opted not to employ any augmentation techniques and concentrated on developing models that can robustly deal with imbalanced data. Furthermore, the collection of samples from underrepresented malware classes is a major challenge. To collect these samples, it is often necessary to deploy advanced honeynets or other specialized techniques, which can be both expensive and resource intensive. This issue can be resolved through collaboration within the cybersecurity community to facilitate safer sharing of malware samples. The development of more sophisticated and cost-effective honeypot technologies can also help to capture a wider range of malware samples to enhance the diversity of the dataset. Another specific challenge of the topological feature dataset is the requirement of further exploration of diverse feature extraction techniques. The current features work. However, other topological measures can be explored to discriminate subtle variations in malware behaviors that are not captured by the current feature set. This may improve the model’s ability to distinguish goodware from similar malware instances, and thus improve classification performance.
AMD-FCG
17
5 Conclusion In this work, we present AMD-FCG, a malware dataset enriched with Function Call Graph (FCG) data and topological features for advanced malware detection and classification. The importance of AMD-FCG is that it can reflect the features and the relationships of malware function calls by static analysis. So, it is a valuable resource for researchers. In comparison with the datasets based on the dynamic analysis, AMD-FCG offers a quicker and more efficient way to produce significant data representations for rapid classification and analysis. The dataset is tested by both Graph Neural Network (GNN) and traditional machine learning models. The success of the dataset demonstrates its versatility and effectiveness in the training and benchmarking of the algorithms for malware detection. By making AMD-FCG publicly available, we aim to contribute to the advancement of cybersecurity research and support the development of more robust malware detection systems.
Declarations Conflict of interest Conflict of Interest: On behalf of all authors, the corresponding author states that there is no conflict of interest.
Authors’ contributions Ethics approval and consent to participate Not applicable
Availability of data and material Made available on request
Consent for publication On behalf of all the authors, “I, the Corresponding Author, declare that this manuscript is original, has not been published before, and is not currently being considered for publication elsewhere.
Funding Not applicable
References [1] Aslan, Ö.A., Samet, R.: A comprehensive review on malware detection approaches. IEEE access 8, 6249–6271 (2020)
18
AMD-FCG
[2] Kramer, S., Bradfield, J.C.: A general definition of malware. Journal in computer virology 6, 105–114 (2010) [3] You, I., Yim, K.: Malware obfuscation techniques: A brief survey. In: 2010 International Conference on Broadband, Wireless Computing, Communication and Applications, pp. 297–300 (2010). IEEE [4] Or-Meir, O., Nissim, N., Elovici, Y., Rokach, L.: Dynamic malware analysis in the modern era—a state of the art survey. ACM Computing Surveys (CSUR) 52(5), 1–48 (2019) [5] Ye, Y., Li, T., Adjeroh, D., Iyengar, S.S.: A survey on malware detection using data mining techniques. ACM Computing Surveys (CSUR) 50(3), 1–40 (2017) [6] Moser, A., Kruegel, C., Kirda, E.: Limits of static analysis for malware detection. In: Twenty-third Annual Computer Security Applications Conference (ACSAC 2007), pp. 421–430 (2007). IEEE [7] Chakkaravarthy, S.S., Sangeetha, D., Vaidehi, V.: A survey on malware analysis and mitigation techniques. Computer Science Review 32, 1–23 (2019) [8] Egele, M., Scholte, T., Kirda, E., Kruegel, C.: A survey on automated dynamic malware-analysis techniques and tools. ACM computing surveys (CSUR) 44(2), 1–42 (2008) [9] Yao, G., Lei, T., Zhong, J.: A review of convolutional-neural-networkbased action recognition. Pattern Recognition Letters 118, 14–22 (2019) [10] Freitas, S., Dong, Y., Neil, J., Chau, D.H.: A large-scale database for graph representation learning. arXiv preprint arXiv:2011.07682 (2020) [11] Wei, F., Li, Y., Roy, S., Ou, X., Zhou, W.: Deep ground truth analysis of current android malware. In: International Conference on Detection of Intrusions and Malware, and Vulnerability Assessment (DIMVA’17), pp. 252–276. Springer, Bonn, Germany (2017) [12] Borah, P., Bhattacharyya, D., Kalita, J.: Malware dataset generation and evaluation. In: 2020 IEEE 4th Conference on Information & Communication Technology (CICT), pp. 1–6 (2020). IEEE [13] Zhang, J., Qin, Z., Zhang, K., Yin, H., Zou, J.: Dalvik opcode graph based android malware variants detection using global topology features. IEEE Access 6, 51964–51974 (2018)
AMD-FCG
19
[14] Fraley, J.B., Figueroa, M.: Polymorphic malware detection using topological feature extraction with data mining. In: SoutheastCon 2016, pp. 1–7 (2016). IEEE [15] Wu, P., Wang, J., Tian, B.: Software homology detection with software motifs based on function-call graph. IEEE Access 6, 19007–19017 (2018) [16] Pranav, P., Edelsbrunner, H., Van de Weygaert, R., Vegter, G., Kerber, M., Jones, B.J., Wintraecken, M.: The topology of the cosmic web in terms of persistent betti numbers. Monthly Notices of the Royal Astronomical Society 465(4), 4281–4310 (2017) [17] Jonsson, J.: Simplicial Complexes of Graphs vol. 1928. Springer, Berlin, Heidelberg (2008) [18] Munkres, J.R.: Elements of Algebraic Topology. CRC press, Boca Raton (2018) [19] Carlsson, G.: Topology and data. Bulletin of the American Mathematical Society 46(2), 255–308 (2009) [20] Stillwell, J.: Classical Topology and Combinatorial Group Theory vol. 72. Springer, New York, NY (2012) [21] Rucco, M., Castiglione, F., Merelli, E., Pettini, M.: Characterisation of the idiotypic immune network through persistent entropy. In: Proceedings of ECCS 2014: European Conference on Complex Systems, pp. 117–128 (2016). Springer [22] Matsumoto, Y.: An Introduction to Morse Theory vol. 208. American Mathematical Soc., Providence, RI (2002) [23] Milnor, J.W.: Morse Theory vol. 51. Princeton university press, Princeton, NJ (1963) [24] Zomorodian, A., Carlsson, G.: Computing persistent homology. In: Proceedings of the Twentieth Annual Symposium on Computational Geometry, pp. 347–356 (2004) [25] Carriere, M., Michel, B., Oudot, S.: Statistical analysis and parameter selection for mapper. Journal of Machine Learning Research 19(12), 1–39 (2018)