{"id":"https://openalex.org/W7171775022","doi":"https://doi.org/10.48550/arxiv.2607.26634","title":"Guarding Organizations Against Malware Risk: A Novel Graph-Based Malware Detection Method","display_name":"Guarding Organizations Against Malware Risk: A Novel Graph-Based Malware Detection Method","publication_year":2026,"publication_date":"2026-07-29","ids":{"openalex":"https://openalex.org/W7171775022","doi":"https://doi.org/10.48550/arxiv.2607.26634"},"language":null,"primary_location":{"id":"doi:10.48550/arxiv.2607.26634","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2607.26634","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"type":"preprint","indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.48550/arxiv.2607.26634","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5144038672","display_name":"Yinan Gao","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Gao, Yinan","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5076289391","display_name":"Jiarong Xu","orcid":"https://orcid.org/0000-0003-2973-1889"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Xu, Jiarong","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5144083714","display_name":"Xiaohang Zhao","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Zhao, Xiaohang","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5130384741","display_name":"Xiao Fang","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Fang, Xiao","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.8144000172615051,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.8144000172615051,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.056299999356269836,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.019600000232458115,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/malware","display_name":"Malware","score":0.8324999809265137},{"id":"https://openalex.org/keywords/byte","display_name":"Byte","score":0.48899999260902405},{"id":"https://openalex.org/keywords/graph","display_name":"Graph","score":0.47350001335144043},{"id":"https://openalex.org/keywords/identification","display_name":"Identification (biology)","score":0.45570001006126404},{"id":"https://openalex.org/keywords/software","display_name":"Software","score":0.4083000123500824},{"id":"https://openalex.org/keywords/representation","display_name":"Representation (politics)","score":0.39070001244544983},{"id":"https://openalex.org/keywords/cryptovirology","display_name":"Cryptovirology","score":0.37310001254081726}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8379999995231628},{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.8324999809265137},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.5042999982833862},{"id":"https://openalex.org/C43364308","wikidata":"https://www.wikidata.org/wiki/Q8799","display_name":"Byte","level":2,"score":0.48899999260902405},{"id":"https://openalex.org/C132525143","wikidata":"https://www.wikidata.org/wiki/Q141488","display_name":"Graph","level":2,"score":0.47350001335144043},{"id":"https://openalex.org/C116834253","wikidata":"https://www.wikidata.org/wiki/Q2039217","display_name":"Identification (biology)","level":2,"score":0.45570001006126404},{"id":"https://openalex.org/C2777904410","wikidata":"https://www.wikidata.org/wiki/Q7397","display_name":"Software","level":2,"score":0.4083000123500824},{"id":"https://openalex.org/C2776359362","wikidata":"https://www.wikidata.org/wiki/Q2145286","display_name":"Representation (politics)","level":3,"score":0.39070001244544983},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.3750999867916107},{"id":"https://openalex.org/C84525096","wikidata":"https://www.wikidata.org/wiki/Q3506050","display_name":"Cryptovirology","level":3,"score":0.37310001254081726},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.35429999232292175},{"id":"https://openalex.org/C97686452","wikidata":"https://www.wikidata.org/wiki/Q7604153","display_name":"Static analysis","level":2,"score":0.35370001196861267},{"id":"https://openalex.org/C27458966","wikidata":"https://www.wikidata.org/wiki/Q1187693","display_name":"Control flow graph","level":2,"score":0.33880001306533813},{"id":"https://openalex.org/C2779639559","wikidata":"https://www.wikidata.org/wiki/Q7661178","display_name":"Symbolic execution","level":3,"score":0.30889999866485596},{"id":"https://openalex.org/C26713055","wikidata":"https://www.wikidata.org/wiki/Q245962","display_name":"Implementation","level":2,"score":0.2996000051498413},{"id":"https://openalex.org/C80444323","wikidata":"https://www.wikidata.org/wiki/Q2878974","display_name":"Theoretical computer science","level":1,"score":0.29760000109672546},{"id":"https://openalex.org/C98183937","wikidata":"https://www.wikidata.org/wiki/Q2112188","display_name":"Program analysis","level":2,"score":0.2888999879360199},{"id":"https://openalex.org/C115903868","wikidata":"https://www.wikidata.org/wiki/Q80993","display_name":"Software engineering","level":1,"score":0.2847999930381775},{"id":"https://openalex.org/C88230418","wikidata":"https://www.wikidata.org/wiki/Q131476","display_name":"Graph theory","level":2,"score":0.2766000032424927},{"id":"https://openalex.org/C102379954","wikidata":"https://www.wikidata.org/wiki/Q2589940","display_name":"Call graph","level":2,"score":0.26019999384880066},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.25099998712539673}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.48550/arxiv.2607.26634","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2607.26634","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"doi:10.48550/arxiv.2607.26634","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2607.26634","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"sustainable_development_goals":[{"score":0.7085363268852234,"display_name":"Peace, Justice and strong institutions","id":"https://metadata.un.org/sdg/16"}],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Organizational":[0],"digitalization":[1],"expands":[2],"cybersecurity":[3,6],"risks,":[4,18],"making":[5],"an":[7,120],"increasingly":[8],"important":[9],"research":[10],"area":[11],"in":[12],"Information":[13],"Systems":[14],"(IS).":[15],"Among":[16],"these":[17,135],"malware":[19,36,107,112],"has":[20],"become":[21],"a":[22,105,126],"pervasive":[23],"and":[24,125,177,190],"destructive":[25],"threat.":[26],"Byte-based":[27],"machine":[28],"learning":[29,130],"(ML)":[30],"methods":[31,52],"are":[32,53],"widely":[33],"used":[34],"for":[35,96,110],"detection":[37,108,188],"but":[38],"remain":[39],"vulnerable":[40],"to":[41,48,147],"evasive":[42],"behaviors":[43,150],"that":[44,66,81,151,185],"manipulate":[45],"raw":[46],"bytes":[47],"evade":[49],"detection.":[50,98],"Graph-based":[51],"less":[54],"affected":[55],"by":[56,167],"such":[57],"manipulations":[58],"because":[59],"they":[60,71,89],"represent":[61],"software":[62],"as":[63,141],"program":[64,85,93,127,149,164],"graphs":[65],"capture":[67,148],"execution":[68],"behavior.":[69],"However,":[70],"do":[72,88],"not":[73,153],"explicitly":[74],"identify":[75],"cohesive":[76,136],"groups":[77,137],"of":[78,138,195],"basic":[79,139,158],"blocks":[80,140],"jointly":[82],"realize":[83],"meaningful":[84],"behaviors,":[86],"nor":[87],"learn":[90],"sufficiently":[91],"expressive":[92,163],"graph":[94,128,165,180],"representations":[95,166],"accurate":[97],"To":[99],"this":[100],"end,":[101],"we":[102],"propose":[103],"MalGuard,":[104],"graph-based":[106],"method":[109],"organizational":[111],"risk":[113],"management.":[114],"MalGuard":[115,186],"introduces":[116],"two":[117],"methodological":[118],"innovations:":[119],"operational":[121,142,171],"role":[122],"identification":[123],"approach":[124],"representation":[129],"method.":[131],"The":[132,160],"former":[133],"identifies":[134],"roles,":[143,172],"enabling":[144],"the":[145,192],"detector":[146],"may":[152],"be":[154],"visible":[155],"from":[156],"isolated":[157],"blocks.":[159],"latter":[161],"learns":[162],"modeling":[168],"interactions":[169],"among":[170],"preserving":[173],"sparse":[174],"malicious":[175],"signals,":[176],"capturing":[178],"hierarchical":[179],"structure.":[181],"Extensive":[182],"experiments":[183],"show":[184],"improves":[187],"performance":[189],"reduces":[191],"expected":[193],"cost":[194],"undetected":[196],"malware.":[197]},"counts_by_year":[],"updated_date":"2026-07-31T08:31:51.225901","created_date":"2026-07-31T00:00:00"}