MalFHG: Full-History Behavior Graphs with Edge-Type Decoupled Networks for Temporal Malware Detection

FAIR'2026

19th National Scientific Conference on Fundamental and Applied IT Research
Theme: "Artificial Intelligence and Its Future Trends"

📅 October 08–09, 2026 · Ho Chi Minh City, Vietnam

Affiliation: Posts and Telecommunications Institute of Technology (PTIT)

Track: AI & Soft Computing · IEEE Proceedings with DOI

Foundation: ETDNet — Mohammed et al., ECAI 2025 (arXiv:2508.03251v2)

Limitations of Current Approaches

Three major limitations of current GNN-based malware detection methods leave multi-stage attacks undetected.

① Static Graph GNNs (GCN, GAT on CFG/FCG)

Only capture code structure at a single point in time → miss behavioral evolution over time

② Dynamic GNNs Mix Signals (DEGCN, ATGAT)

Blend spatial information (which API calls which) with temporal information (calling order across stages) → over-smoothing, reduced discriminative power

③ No Full History Preservation

Use sliding windows or truncation → lose long-range dependencies, fail to detect multi-stage attacks

Research Gap — A Clear Opening

After thorough survey across Google Scholar, arXiv, IEEE Xplore, and DBLP (as of August 2026), a striking void emerges at the intersection of three emerging directions.

~ 0

Results Found

"Full-History Graph" + "malware detection"

< 10

Results Found

"Edge-type decoupled" + "cybersecurity" or "Temporal / Spatio"

Gap Identified

Existing Work Falls Short

Spatiotemporal graph papers in security — ST-Graph, IF2-STG, DynMD, API2Vec++ — use intra/inter concepts but in fundamentally different ways. None combines:

1

Full-History Graph (FHG) representation

2

Dual-branch decoupled attention

3

Malware behavior analysis

Foundation Paper — ETDNet (ECAI 2025)

Authors

Mohammed et al., University of Stuttgart (arXiv:2508.03251v2, ECAI 2025)

Full-History Graph (FHG)

Entire timeline preserved — no sliding window truncation. No information loss.

Decoupled Edge Types

Intra-timestep edges (D) and Inter-timestep edges (H) handled separately.

Dual-Branch Architecture

Step Attention (SA) + History Attention (HA) + Fusion Layer — each branch a dedicated expert.

Key Results

+1.2 Joint Accuracy

On Waymo (autonomous driving)

+13.3 F1

On Elliptic++ vs. TGN (blockchain fraud)

Only 0.30M Params

3× lighter than TGN

14% Faster

40% less memory at inference

What is a Full-History Graph (FHG)?

Treats the entire execution timeline as a "cinematic filmstrip" — every frame preserved, every transition encoded. No deletion, no overwriting.

🎬 Dynamic Node (u_t)

A replica of an entity at timestep t — e.g., API_call at window t. Each timestep gets its own node copy.

🔒 Static Node (s)

An invariant entity shared across ALL timesteps — e.g., kernel32.dll. Provides persistent identity across the timeline.

↔️ Intra-edge (D)

Links nodes WITHIN the same timestep t → encodes spatial (behavioral) relationships between co-occurring API calls.

Inter-edge (H)

Links nodes ACROSS timesteps t → t+1 → encodes temporal succession. The full chain is never deleted or overwritten.

📜 Full History

Preserves the ENTIRE execution history — no deletion, no overwriting. Every transition remains accessible for downstream attention layers.

MalFHG Proposal — Three Key Contributions

C1 — Full-History Behavior Graph (FHBehG)

First-ever FHG construction for malware execution traces. Preserves the entire execution chain, enabling multi-stage attack detection.

C2 — Edge-Type Decoupled Architecture

Applies SA/HA dual-branch to behavioral graph analysis. Separates behavioral patterns (within window) from temporal evolution (across windows).

C3 — Dual-Attention Explainability

SA weights → "Which APIs are most suspicious?"
HA weights → "Which execution phase triggered the detection?"

Mapping FHG Concepts to the Malware Domain

ETDNet was originally designed for autonomous driving (Waymo) and blockchain fraud (Elliptic++). MalFHG re-interprets every FHG primitive in the malware execution context.

MalFHG Architecture — End-to-End Pipeline

MalFHG transforms a raw malware binary into a graph-level classification through five tightly integrated stages.

Input

Malware Sample (PE/APK binary)

Dynamic Analysis

Cuckoo/CopperDroid Sandbox → API Trace extraction

FHBehG Construction

Segment into windows → Dynamic/Static nodes + D/H edges

ETDNet Processing

SA (behavioral) + HA (temporal) + Fusion × L=3 layers

Output

Graph Readout → MLP → Benign / Malware / Family classification

Related Work — Spatiotemporal Graphs in Cybersecurity

Existing papers DO use spatiotemporal graphs with intra/inter edges in security, but ALL differ from MalFHG in critical ways.

Malware Detection

API2Vec++ (IEEE TSE, 2024, 16 cit.)

Dual graph with TAPG (intra-process) + TPG (inter-process). Uses BERT embedding + random walk, NOT GNN attention. No full history.

DynMD (IEEE TDSC, 2026)

Energy-based adaptive graph partitioning with intra/inter-graph message passing. Single GNN module, NOT dual-branch.

MG-DVD (2021)

Dynamic heterogeneous graph with meta-graph patterns. Outperformed by DynMD.

Network/Intrusion Detection

ST-Graph (RAID 2022, 60 cit.)

Spatiotemporal graph for encrypted traffic. Uses Random Forest, NOT GNN.

IF2-STG (IEEE TNSE, 2026)

Intra-flow features + Inter-flow STG — closest to dual-branch concept, but for IDS, not malware.

DSTEGNN (2026)

Adaptive edge learning + GNNExplainer, but NOT dual-branch architecture.

Comparison with Existing Research

MalFHG is benchmarked against representative GNN-based malware detection methods. It is the ONLY method achieving across all four critical criteria.

Primary Dataset — BODMAS

Dataset Overview

  • 134,435 PE samples total: 57K malware + 77K benign
  • 581 malware families — broad taxonomic coverage across threat types
  • Timestamped collection: 2019–2020 → enables temporal analysis & concept drift studies
  • Used at NDSS 2025 (top security venue), cited in 4+ studies (2023–2026)

Why BODMAS?

Large scale: 134K+ samples for robust training

Temporal labels: enables concept drift evaluation

Family labels: 581 families for fine-grained classification

Community validated: NDSS 2025 benchmark

Supplementary Dataset — CICMalDroid 2020

Dataset Overview

  • 17,341 Android application samples across 5 behavioral categories
  • 5 categories: Adware, Banking Malware, SMS Malware, Riskware, Benign
  • Collected by the Canadian Institute for Cybersecurity
  • Dynamic traces already available via CopperDroid VMI — reducing preprocessing overhead
Cross-Platform Validation Strategy

🖥️ BODMAS (Windows PE) + 📱 CICMalDroid (Android APK) = cross-platform validation

🔄 Mirrors ETDNet's cross-domain design: Waymo (traffic) + Elliptic++ (blockchain)

🌐 Demonstrates MalFHG's generalizability across OS platforms

⚙️ Android dynamic traces directly usable for FHBehG construction

Experimental Design — Four Experiments

The evaluation protocol rigorously validates every architectural claim: end-to-end performance, component necessity, hyperparameter robustness, and interpretability.

01

Main Comparison

vs 6 baselines: GCN, GAT, GraphSAGE, TGN, TGAT, EvolveGCN. Metrics: Accuracy, F1, Precision, Recall.

02

Ablation Study

Only-SA, Only-HA, No Fusion, Mean Pool vs Full MalFHG. Proves each component is necessary.

03

Sensitivity Analysis

Hyperparameters: B (predecessors), L (layers), heads, window size. Validates robustness.

04

XAI Visualization

SA attention heatmaps + HA temporal timelines. Provides interpretability for security analysts.

Conclusion & Contributions

MalFHG is the FIRST work to combine:

Full-History Graph (FHBehG)

First-ever FHG representation for malware execution traces

Edge-Type Decoupled Architecture

SA + HA dual-branch separating spatial and temporal signals

Dual-Attention Explainability

Interpretable detection for cybersecurity analysts

Alignment with FAIR'2026

Track: AI & Soft Computing
Theme: Artificial Intelligence and Its Future Trends
Keywords: Deep Learning, Graph Neural Networks, Malware Detection, Cybersecurity AI
Publication: IEEE Proceedings with DOI