10.1109/ACCESS.2026.3738324">
 

Document Type

Article

Publication Date

9-29-2026

Abstract

Most malware detection continues to rely on signature matching, which struggles with obfuscated or novel variants. This research presents a malware detector that instead relies on the static structure of function call graphs, summarized using L-moments of the degree, betweenness, closeness, and clustering measures into compact, interpretable descriptors that persist across malware variants. Evaluated on 175,633 binaries spanning many families under balanced, natural-prevalence, and prevalence-weighted training regimes, ensemble methods achieved Area Under the Curve (AUC) values up to 0.98 on the full-corpus random split, while a feed-forward neural network remained robust across regimes with AUC 0.92–0.95. Linear baselines were far more sensitive to training prevalence, with weighted F1 dropping sharply under natural-prevalence training. Two leakage controls accompany the headline: a group-aware split preserving AUC 0.984, showing that duplicate leakage is not the primary driver of the result, and a collapse-to-unique bound of 0.915 on structurally novel samples. Ablation on a deduplicated 27-feature set shows that distributional moment summaries, rather than whole-graph statistics, carry most of the discriminative signal. Family-wise cross-validation confirms performance holds on unseen malware families, and leave-one-source-out and source-prediction probes show that detection does not reduce to exploiting collection-source provenance. Explainability traces decisions to graph statistics using TreeSHAP on the production tree ensembles and to individual functions using a validated tree-model occlusion procedure.

Comments

© 2026 The Authors. 

This article is published by IEEE, licensed under a Creative Commons Attribution 4.0 International License (CC BY 4.0), which permits use, sharing, adaptation, distribution and reproduction in any medium or format, as long as you give appropriate credit to the original author(s) and the source, provide a link to the Creative Commons license, and indicate if changes were made.

Sourced from the published version of record cited below. 

This article was published online by IEEE ahead of inclusion in an issue of IEEE Access.

Source Publication

IEEE Access (eISSN 2169-3536)

Download

Share

COinS