Modern malware uses more and more advanced evasion techniques, like packing, polymorphism, fileless execution, reflective loading, and living-off-the-land behaviors. This makes traditional signature-based and static detection methods much less effective. Dynamic behavioral analysis—recording API and system-call traces, process interactions, memory activities, and network events—offers deeper semantic understanding of runtime malware behavior, yet generates highly structured, noisy, and evolving data. To tackle this issue, graph-based representations such as API-call graphs, control-flow graphs, system dependency graphs, and heterogeneous process-resource graphs have proven to be effective abstractions for modeling malware behavior.Graph Neural Networks (GNNs), which include convolutional, attention-based, temporal, and self-supervised types, have shown that they can find new types of malware and variants that act similarly to existing ones. Nonetheless, behavioral and conceptual drift, adversarial graph manipulation, restricted explainability, scalable graph extraction, and real-time deployment limitations persist as significant obstacles to operational implementation.This survey methodically examines GNN-based malware detection research published from 2020 to 2025, focusing specifically on drift-aware learning, explainable GNN models, and deployment-oriented factors. We classify current research based on graph construction strategies, GNN architectures, self-supervised and contrastive learning methodologies, robustness mechanisms, and evaluation protocols. Lastly, we talk about open research problems and suggest ways to move forward in creating GNN-based malware defense systems that are strong, easy to understand, and can be used in the real world.
No new data were created or analyzed in this study. Data sharing is not applicable to this article.
The authors declare no conflict of interest.
The author(s) conducted the literature review, analyzed existing malware detection techniques, organized the findings, and wrote the manuscript. All authors reviewed and approved the final version of the manuscript.
This research received no external funding.
Reference management and manuscript preparation were carried out using standard word processing and citation management tools.
Not applicable.
[1] C. Li, X. Zhang, Y. Wang, and J. Liu, “DMalNet: Dynamic malware analysis based on API features and graph neural networks,” Computers & Security, vol. 114, Art. no. 102580, 2022. [2] J. Busch, L. Payer, and K. Rieck, “Network flow graph neural networks for malware detection,” in Proc. Int. Conf. on Detection of Intrusions and Malware, 2021. [3] J. D. Herath, “CFGExplainer: Explaining graph neural network-based malware classification,” in Proc. IEEE/IFIP Int. Conf. on Dependable Systems and Networks (DSN), 2022. [4] Y. Gao, Q. Wang, and Z. Li, “Malware self-supervised graph contrastive learning with data augmentation,” in Proc. IEEE INFOCOM Workshops, 2023. [5] A. Bensaoud, “A survey of malware detection using deep learning,” Journal of Information Security and Applications, vol. 76, Art. no. 103671, 2024. [6] H. Haddadpajouh, A. Dehghantanha, and R. M. Parizi, “A deep learning-based approach for malware detection using behavioral graphs,” Computers & Security, vol. 105, Art. no. 102208, 2021. [7] W. Li, Y. Chen, and Z. Zhang, “TS-Mal: Malware detection using temporal and structural features,” Computers & Security, vol. 130, Art. no. 103268, 2024. [8] W. Wang, Y. Shang, and X. Li, “Heterogeneous graph neural networks for malicious behavior detection,” IEEE Transactions on Information Forensics and Security, vol. 17, pp. 3211–3224, 2022. [9] D. Arp, M. Spreitzenbarth, H. Gascon, K. Rieck, and C. Siemens, “DREBIN: Effective and explainable detection of Android malware in your pocket,” in Proc. NDSS, 2014. [10] H. S. Anderson and P. Roth, “EMBER: An open dataset for training static PE malware machine learning models,” arXiv preprint arXiv:1804.04637, 2018. [11] R. Jordaney, K. Sharad, S. Dash, and L. Cavallaro, “Transcend: Detecting concept drift in malware classification,” in Proc. USENIX Security Symposium, 2017. [12] M. Alasmary, A. Alhaidari, and A. Alzahrani, “Dynamic malware analysis using system-call dependency graphs,” Journal of Information Security and Applications, vol. 54, Art. no. 102547, 2020. [13] H. Peng, J. Li, and Y. Zhang, “Evading control flow graph–based graph neural network malware detectors,” Scientific Reports, vol. 15, Art. no. 11234, 2025. [14] D. Zügner and S. Günnemann, “Adversarial attacks on graph neural networks,” in Proc. ACM SIGKDD, 2019. [15] Y. You, T. Chen, Z. Wang, and Y. Shen, “Graph contrastive learning with augmentations,” in Proc. NeurIPS, 2020. [16] M. Ribeiro, S. Singh, and C. Guestrin, “Why should I trust you? Explaining the predictions of any classifier,” in Proc. ACM SIGKDD, 2016. [17] M. Egele, T. Scholte, E. Kirda, and C. Kruegel, “A survey on automated dynamic malware analysis techniques,” ACM Computing Surveys, vol. 44, no. 2, pp. 1–42, 2012. [18] W. Hamilton, Z. Ying, and J. Leskovec, “Inductive representation learning on large graphs,” in Proc. NeurIPS, 2017. [19] T. Kipf and M. Welling, “Semi-supervised classification with graph convolutional networks,” in Proc. ICLR, 2017. [20] P. Velickovic et al., “Graph attention networks,” in Proc. ICLR, 2018. [21] K. Xu et al., “How powerful are graph neural networks?” in Proc. ICLR, 2019. [22] Y. Li, D. Tarlow, M. Brockschmidt, and R. Zemel, “Gated graph sequence neural networks,” in Proc. ICLR, 2016. [23] S. Wu et al., “A comprehensive survey on graph neural networks,” IEEE Transactions on Neural Networks and Learning Systems, vol. 32, no. 1, pp. 4–24, 2021. [24] Z. Chen et al., “Temporal graph neural networks for dynamic malware detection,” Future Generation Computer Systems, vol. 140, pp. 34–45, 2023. [25] Y. Zhen, L. Wang, and H. Zhang, “A novel malware detection method based on audit logs and graph neural networks,” Computers & Security, vol. 132, Art. no. 103312, 2025. [26] F. Ahmed, H. Hameed, M. Z. Shafiq, and M. Farooq, “Using spatio-temporal information in API calls for malware detection,” in Proc. ACM CCS, 2009. [27] U. Bayer et al., “Scalable, behavior-based malware clustering,” in Proc. NDSS, 2009. [28] A. Rosenberg et al., “Explainable graph neural networks for cybersecurity applications,” IEEE Security & Privacy, vol. 20, no. 3, pp. 58–67, 2022. [29] S. Hou et al., “Explainable malware detection with graph neural networks,” Pattern Recognition, vol. 138, Art. no. 109370, 2023. [30] A. Singhal and X. Ou, “Security risk analysis of enterprise networks using probabilistic attack graphs,” IEEE Transactions on Dependable and Secure Computing, vol. 8, no. 3, pp. 417–430, 2011.