19th National Scientific Conference on Fundamental and Applied IT Research
Theme: "Artificial Intelligence and Its Future Trends"
📅 October 08–09, 2026 · Ho Chi Minh City, Vietnam
Affiliation: Posts and Telecommunications Institute of Technology (PTIT)
Track: AI & Soft Computing · IEEE Proceedings with DOI
Foundation: ETDNet — Mohammed et al., ECAI 2025 (arXiv:2508.03251v2)
Three major limitations of current GNN-based malware detection methods leave multi-stage attacks undetected.
Only capture code structure at a single point in time → miss behavioral evolution over time
Blend spatial information (which API calls which) with temporal information (calling order across stages) → over-smoothing, reduced discriminative power
Use sliding windows or truncation → lose long-range dependencies, fail to detect multi-stage attacks
After thorough survey across Google Scholar, arXiv, IEEE Xplore, and DBLP (as of August 2026), a striking void emerges at the intersection of three emerging directions.
"Full-History Graph" + "malware detection"
"Edge-type decoupled" + "cybersecurity" or "Temporal / Spatio"
Spatiotemporal graph papers in security — ST-Graph, IF2-STG, DynMD, API2Vec++ — use intra/inter concepts but in fundamentally different ways. None combines:
Mohammed et al., University of Stuttgart (arXiv:2508.03251v2, ECAI 2025)
Entire timeline preserved — no sliding window truncation. No information loss.
Intra-timestep edges (D) and Inter-timestep edges (H) handled separately.
Step Attention (SA) + History Attention (HA) + Fusion Layer — each branch a dedicated expert.
On Waymo (autonomous driving)
On Elliptic++ vs. TGN (blockchain fraud)
3× lighter than TGN
40% less memory at inference
Treats the entire execution timeline as a "cinematic filmstrip" — every frame preserved, every transition encoded. No deletion, no overwriting.
A replica of an entity at timestep t — e.g., API_call at window t. Each timestep gets its own node copy.
An invariant entity shared across ALL timesteps — e.g., kernel32.dll. Provides persistent identity across the timeline.
Links nodes WITHIN the same timestep t → encodes spatial (behavioral) relationships between co-occurring API calls.
Links nodes ACROSS timesteps t → t+1 → encodes temporal succession. The full chain is never deleted or overwritten.
Preserves the ENTIRE execution history — no deletion, no overwriting. Every transition remains accessible for downstream attention layers.
First-ever FHG construction for malware execution traces. Preserves the entire execution chain, enabling multi-stage attack detection.
Applies SA/HA dual-branch to behavioral graph analysis. Separates behavioral patterns (within window) from temporal evolution (across windows).
SA weights → "Which APIs are most suspicious?"
HA weights → "Which execution phase triggered the detection?"
ETDNet was originally designed for autonomous driving (Waymo) and blockchain fraud (Elliptic++). MalFHG re-interprets every FHG primitive in the malware execution context.
MalFHG transforms a raw malware binary into a graph-level classification through five tightly integrated stages.
Malware Sample (PE/APK binary)
Cuckoo/CopperDroid Sandbox → API Trace extraction
Segment into windows → Dynamic/Static nodes + D/H edges
SA (behavioral) + HA (temporal) + Fusion × L=3 layers
Graph Readout → MLP → Benign / Malware / Family classification
Existing papers DO use spatiotemporal graphs with intra/inter edges in security, but ALL differ from MalFHG in critical ways.
Dual graph with TAPG (intra-process) + TPG (inter-process). Uses BERT embedding + random walk, NOT GNN attention. No full history.
Energy-based adaptive graph partitioning with intra/inter-graph message passing. Single GNN module, NOT dual-branch.
Dynamic heterogeneous graph with meta-graph patterns. Outperformed by DynMD.
Spatiotemporal graph for encrypted traffic. Uses Random Forest, NOT GNN.
Intra-flow features + Inter-flow STG — closest to dual-branch concept, but for IDS, not malware.
Adaptive edge learning + GNNExplainer, but NOT dual-branch architecture.
MalFHG is benchmarked against representative GNN-based malware detection methods. It is the ONLY method achieving ✅ across all four critical criteria.
✅ Large scale: 134K+ samples for robust training
✅ Temporal labels: enables concept drift evaluation
✅ Family labels: 581 families for fine-grained classification
✅ Community validated: NDSS 2025 benchmark
🖥️ BODMAS (Windows PE) + 📱 CICMalDroid (Android APK) = cross-platform validation
🔄 Mirrors ETDNet's cross-domain design: Waymo (traffic) + Elliptic++ (blockchain)
🌐 Demonstrates MalFHG's generalizability across OS platforms
⚙️ Android dynamic traces directly usable for FHBehG construction
The evaluation protocol rigorously validates every architectural claim: end-to-end performance, component necessity, hyperparameter robustness, and interpretability.
vs 6 baselines: GCN, GAT, GraphSAGE, TGN, TGAT, EvolveGCN. Metrics: Accuracy, F1, Precision, Recall.
Only-SA, Only-HA, No Fusion, Mean Pool vs Full MalFHG. Proves each component is necessary.
Hyperparameters: B (predecessors), L (layers), heads, window size. Validates robustness.
SA attention heatmaps + HA temporal timelines. Provides interpretability for security analysts.
First-ever FHG representation for malware execution traces
SA + HA dual-branch separating spatial and temporal signals
Interpretable detection for cybersecurity analysts
Track: AI & Soft Computing
Theme: Artificial Intelligence and Its Future Trends
Keywords: Deep Learning, Graph Neural Networks, Malware Detection, Cybersecurity AI
Publication: IEEE Proceedings with DOI
MalFHG: Full-History Behavior Graphs with Edge-Type Decoupled Networks for Temporal Malware Detection