Community prototypes do not improve malware family rejection in graphs
Residual Community Prototypes Under-Reject Held-Out Malware Families in FCG-MFD
Cryptography and Security
Summary
This paper looks at how well certain graph-based techniques can recognize malware families they have seen before while rejecting new, unknown families. The authors tested whether using community detection summaries helps reject unknown malware better than existing graph features alone. They found that these community features did not consistently help detect new malware families and sometimes made the problem worse. However, the approach did slightly improve recognizing known malware types.
What this means in practice
- •For malware analysts: Refine detection systems by understanding that community-based graph features alone do not reliably reject unknown malware families.
- •For cybersecurity engineers: Design open-set malware classifiers that combine structural features with topology controls and threshold tuning for better unknown malware rejection.
Authors
Junru Zhu, Yixin Yang, Xiaoqing Ding, Ruoyu Qi
Abstract
Open-set malware-family recognition must classify known families while rejecting families absent from training. We test whether Louvain-community summaries add rejection information beyond a graph neural network embedding and dimension-matched generic topology. The study uses a deduplicated, conflict-audited FCG-MFD corpus, five held-out families, and three optimization seeds. Community features are residualized against generic topology using known-family training data before nearest-prototype scoring. Residual community does not produce stable held-out-family rejection. Ranking effects reverse across families, the false-positive rate at 95 percent unknown recall worsens for every held-out family, and a validation-fitted threshold rejects only 4.48 percent of unknown samples. Accepted-known macro F1 improves in every family, but with five independent family units the exact two-sided sign-flip p-value is 0.0625, the smallest attainable value. The score remains associated with graph scale, while simple classifier uncertainty performs better on ranking, high-recall rejection, and OSCR. In this GIN/FCG-MFD setting, community-enriched prototypes change known-class geometry without creating a stable unknown margin. Graph open-set evaluations should pair structural features with matched topology controls, operational thresholds, and held-out-family analysis.