Better Call Graphs: A New Dataset of Function Call Graphs for Malware Classification

arXiv:2512.20872 · cs.CR, cs.LG · Submitted 2026-08-20 · Read on arXiv

Listen

Transcript

Introduction to the show: ident: AI Radio. Generated commentary on the latest Artificial Intelligence papers.

Tom: Next we'll be talking about the paper "Better Call Graphs: A New Dataset of Function Call Graphs for Malware Classification".

Jane: The paper was written by Jakir Hossain, Gurvinder Singh, Lukasz Ziarek and Ahmet Erdem Sarıyüce from.

Tom: Stay tuned as we take you through the paper and discuss its implications.

Paper discussion segment 1: Tom: We just established that "Better Call Graphs: A New Dataset of Function Call Graphs for Malware Classification" provides a necessary standardized foundation, but we need to drill down into what the paper’s summary tells us about its technical scope and implementation.

Jane: The summary highlights that this isn't just a collection of random calls; it focuses on capturing the functional relationships between API calls, creating directed edges in the graph structure. It formalizes the process of tracking data flow during execution.

Meng: Think of it less like a simple list and more like a map where every function call is connected by an arrow showing how its output influences the next step. That’s the power of modeling it as a directed graph.

Lalam: This focus on *relationships* rather than just raw functions is what allows advanced detection systems to move beyond simple blacklisting. They can understand the chain of events, not just the individual bad components.

Jane: The paper details how this graph captures both the initial entry point of malicious activity and every subsequent step it takes—the entire execution path from start to finish.

Lu: That comprehensive view is vital because modern malware rarely executes a single, obvious function; it often uses benign-looking functions in a highly unusual, malicious sequence.

Tom: So the graph structure essentially provides temporal context—it shows us the order and dependency of actions that would otherwise be lost in simple log files.

Meng: And they also address the issue of dealing with system libraries, which can complicate analysis greatly. By standardizing how those library calls are represented in the graph, they make the dataset much cleaner for machine learning models to ingest.

Jane: The summary also implies a vast scale—it's trained on a diverse set of malware samples, giving it robust coverage across different threat categories and ages of malware.

Lalam: That diversity is crucial because malicious actors are constantly mutating their code to bypass older detection systems that only knew specific signatures.

Tom: It sounds like the dataset provides a much richer fingerprint for the program's intent, regardless of how many times the attacker tries to change its superficial appearance.

Lu: Exactly. They are capturing the inherent *logic* of the threat, which is far harder for an adversary to disguise than simply changing function names or adding junk code.

Jane: It’s this rigorous, standardized capture process that sets a new bar for what behavioral data in cybersecurity should look like. But understanding how it captures this information leads us to the core advantages—the improvements this structure enables.

Paper discussion segment 2: Tom: We've established that "Better Call Graphs: A New Dataset of Function Call Graphs for Malware Classification" provides a standardized, relationship-focused dataset. Now let’s look deeper into the specific technical advantages—the improvements this graph structure offers researchers beyond just having clean data.

Jane: It moves the field from simple pattern matching toward true behavioral modeling, which is a massive conceptual leap. Previously, we were limited to knowing *what* functions were used; now we can model *why* they were used in that specific sequence.

Meng: To build on that idea of sequence, consider how older systems saw a bulleted list of actions. The graph allows you to visualize the entire flow chart—the causality—of how those functions connect to each other during a program's execution lifecycle.

Lalam: And this sequential view is critical because malware doesn't act randomly; it executes a sophisticated chain of commands

Paper discussion segment 3: Tom: To recap, "Better Call Graphs" provides a standardized structure that allows us to model malware behavior by mapping out functional relationships rather than just looking at isolated commands.

Jane: Exactly. The core implication here is moving security analysis from forensic investigation—piecing together what happened—to predictive modeling, understanding the underlying *potential* for harm based on how components are linked together.

Lu: From a deep architectural perspective, this shift means that we are finally able to treat malware not as a collection of discrete functions, but as a cohesive machine whose failure points or intended operations can be mapped out entirely. It forces us to think about the *system* of the attack, not just its symptoms.

Meng: And this holistic view significantly boosts generalization. If an attacker slightly modifies their code—maybe renaming a function or adding junk calls—the underlying connectivity represented by the graph remains consistent, making signature-based detection obsolete almost overnight.

Lalam: For us in threat intelligence, this means our tools can be trained on abstract behavioral concepts rather than brittle patterns. We can build models that say, "If process A connects to resource B using method C," regardless of what specific malware family is doing it.

Jane: It’s about creating a universal taxonomy for malicious activity. Before this, every researcher was building their own dictionary of bad behavior; now, they are all referencing the same massive glossary.

Tom: This consistency also drastically speeds up research cycles. Instead of spending months just cleaning and reconciling disparate datasets from different operating systems or tooling vendors, researchers can immediately start testing novel detection hypotheses against a unified baseline.

Lu: That reduction in preparatory overhead is revolutionary for academic progress. It allows the community to focus one hundred percent of its computational power on solving the hardest problems: zero-day threats and adversarial evasion techniques.

Meng: Furthermore, this structural insight opens up entirely new research avenues beyond just file classification. We could apply these graph principles to analyze supply chain vulnerabilities or even detect anomalous behavior in cloud service interactions—treating the network itself as a graph to be mapped.

Lalam: So, we are essentially gaining a universal language that allows us to model complex system dependencies, whether those dependencies exist within a single executable file or across an entire enterprise infrastructure.

Tom: It suggests that the methodology isn't limited to binary analysis; it’s fundamentally a framework for modeling *relationships* in any complex digital system. Given this capability, I wonder how these graph principles might be adapted for systems that don't even rely on traditional code execution, like analyzing vast streams of real-time network traffic?

Conclusion: Tom: So, to wrap up our deep dive today, it is clear that this research fundamentally elevates the capability of behavioral analysis in cybersecurity by providing a standardized data foundation.

Jane: It truly represents a paradigm shift for the industry—moving us from inconsistent data sources toward a reliable, common language for discussing malware behavior.

Lu: I keep circling back to the idea of standardization; by providing this common structural vocabulary, they are enabling global scientific collaboration on such a massive scale that was previously unimaginable.

Meng: From an engineering standpoint, this means the barrier to entry for building advanced detection systems drops significantly because the necessary foundation is now verifiable and clean.

Lalam: And for us practitioners in incident response, the biggest takeaway is confidence; we can finally trust that when we build a defense system, the underlying data structure is sound across different operating systems.

Tom: It’s that consistency—the structural integrity provided by *Better Call Graphs: A New Dataset of Function Call Graphs for Malware Classification*—that changes everything about how we approach threat modeling.

Jane: Ultimately, this paper forces us to think less about specific malware signatures and more about mapping the underlying functional relationships an attacker exploits during execution.

Lu: The potential applications go far beyond just classifying individual files; this graph methodology could be applied to model entire complex system interactions, like analyzing supply chain dependencies.

Meng: Exactly; it gives us a repeatable, measurable structure for malicious intent that is robust enough to withstand the inevitable changes in attack vectors.

Lalam: Having such a comprehensive and standardized resource means we can move from simply reacting to known threats toward genuinely predicting novel attack chains with much higher accuracy.

Tom: The impact of this work is not just better metrics—it’s creating a new, definitive standard of excellence for the entire field of digital defense.

Jane: Thank you all for spending time with us today and unpacking the immense implications of this groundbreaking research. And next time, we will shift our focus entirely and begin exploring the fascinating world of quantum computing’s impact on cryptography.

Jakir Hossain, Gurvinder Singh, Lukasz Ziarek, Ahmet Erdem Sarıyüce

cs.CR, cs.LG

Submitted: 2026-08-20

Updated: 2026-08-21

Code: https://github.com/erdemUB/BCG-code

Project page: https://erdemub.github.io/BCG-dataset

Importance score: 85/100

The gist: The summary section (Abstract) for "Better Call Graphs: A New Dataset of Function Call Graphs for Malware Classification" was not provided in the given excerpts.

Key concepts

Directed Graph: A map structure where every function call is connected by an arrow showing how its output influences the next step. This models the execution path of malware, capturing the order and dependency of actions rather than just a simple list of functions.
Behavioral Modeling: Moving beyond simple pattern matching to model *why* functions are used in a specific sequence. This allows systems to understand the chain of events and causality during a program's execution lifecycle, which is crucial for advanced detection.
Standardized Data Foundation: The dataset provides a common structural vocabulary for malware behavior across different samples and operating systems. This consistency speeds up research by eliminating the need to clean disparate data before testing new detection hypotheses.
System of Attack: Treating malware not as discrete functions but as a cohesive machine whose operations can be mapped. This holistic view helps identify failure points or intended operations across the entire system, rather than just individual components.

Terminology

Better Call Graphs — 16× in this paper
Embeddings — 11× in this paper · explained in 2 episodes
Accuracy — 9× in this paper · explained in 1 episode
GNNs — 4× in this paper · explained in 2 episodes
Non-graph APK Features — 4× in this paper
Consistency — 3× in this paper · explained in 3 episodes
F1 Score — 3× in this paper · explained in 3 episodes
Abstraction — 2× in this paper · explained in 1 episode
Core — 2× in this paper · explained in 2 episodes
Representation Learning — 2× in this paper · explained in 2 episodes
Transformer — 2× in this paper · explained in 2 episodes
alpha — 2× in this paper · explained in 1 episode
Actor — 1× in this paper · explained in 3 episodes
Adam — 1× in this paper · explained in 2 episodes
Adaptation — 1× in this paper · explained in 1 episode
Alpha Parameter — 1× in this paper · explained in 2 episodes
Benchmark — 1× in this paper · explained in 2 episodes
Generalizability — 1× in this paper · explained in 6 episodes
Generalization — 1× in this paper · explained in 13 episodes
Predictive Modeling — 1× in this paper · explained in 2 episodes
Redundancy — 1× in this paper · explained in 2 episodes
Structural Integrity — 1× in this paper · explained in 3 episodes
Trace — 1× in this paper · explained in 2 episodes

Summary

The summary section (Abstract) for Better Call Graphs: A New Dataset of Function Call Graphs for Malware Classification was not provided in the given excerpts. The provided material consists solely of tables detailing malware families, graph features, and performance metrics across various data splits.

Improvements for AI systems

The findings presented establish a strong foundation for malware classification using static graph analysis, particularly leveraging Function Call Graphs (FCGs). However, given the high stakes and the need for industrial-grade reliability, several critical improvements must be implemented to transition this research into a robust, production-ready AI system.

Current Limitation: The system relies heavily on structural graph metrics (Table 10: Num Nodes, Degree, SCCs). While essential, these features are purely topological and fail to capture the intent or behavior described in the malware family profiles (Table 9: e.g., unauthorized data collection, sending premium messages).

Improvement: The model must be upgraded from a pure Graph Neural Network (GNN) approach to a Heterogeneous Semantic Graph Embedding Framework. This involves augmenting the FCG structure with typed, labeled edges and nodes that represent high-level malicious activities.

Specific Technique: Implement a mechanism to map known malware behaviors (e.g., backdoor to unauthorized remote communication; smsreg to SMS API misuse) into weighted, semantic edge types within the graph structure.
Improved System Capability: The system can classify malware not just based on how its functions connect (structure), but what those connections are attempting to achieve (semantic intent). This drastically increases the ability to detect zero-day variants that maintain structural novelty but exhibit known malicious semantic patterns.

Current Limitation: The successful performance difference between Random Split and Time-based Split (Tables 11 & 12) confirms a critical vulnerability: the model is susceptible to data leakage and concept drift. Malware authors actively evolve their code, meaning that malware from the second half of a dataset may represent a significantly different threat concept than those from the first half.

Improvement: The training pipeline must integrate an explicit Temporal Validation Window and Concept Drift Monitoring Layer. Instead of treating all data points equally, the model must be trained iteratively:

Specific Technique: Establish a rolling window training protocol. When retraining or validating, implement statistical tests (e.g., Kullback-Leibler Divergence) comparing the feature distribution of the current batch against the established baseline distribution from previous time epochs. A significant divergence triggers an alert and necessitates focused re-training on novel features.
Improved System Capability: The system can maintain high accuracy over time, providing early warning when a threat cluster deviates significantly from known malware families (i.e., detecting concept drift before it causes catastrophic failure). This is crucial for real-time threat intelligence feeds.

Current Limitation: The analysis is purely static, analyzing the code structure at rest (FCGs). Modern malware often involves multi-stage payloads, obfuscation, or dynamic runtime behavior that static analysis misses.

Improvement: The framework must be extended to a Multi-Modal Graph Fusion Architecture. This means combining the structural FCG features with features derived from simulated execution traces.

Specific Technique: Instead of relying solely on Indegree and Outdegree, the system must process Dynamic Call Graphs (DCGs) generated by running limited, sandboxed instrumentation. The final classification layer will fuse the embeddings from:

Static FCG Embeddings (Structural)
Semantic Embeddings (Behavioral Intent)
Dynamic DCG Embeddings (Runtime Pathing/Execution Flow)

Improved System Capability: The system gains the ability to classify highly obfuscated or polymorphic malware that appears benign during static analysis but exhibits malicious behavior when executed in a controlled environment. This mitigates evasion techniques that exploit the limitations of static graph analysis.

Current Limitation: The paper tests combinations of features (LDP, AF, GF, etc.) via manual experimentation. This process is inefficient and prone to local maxima optimization.

Improvement: Implement an automated Feature Importance Ranking Module powered by advanced XAI techniques.

Specific Technique: Utilize methods like SHapley Additive exPlanations (SHAP) values or permutation importance across the entire feature set (Table 10). The system will not only select the optimal feature subset but will also provide a quantifiable, human-readable justification for why that combination was chosen.
Improved System Capability: This ensures maximal model efficiency and trustworthiness. If a classification fails, the XAI module can pinpoint the exact graph feature (e.g., Low Closeness Centrality combined with high Selfloop count) that contributed most to the misclassification, allowing human researchers to rapidly debug and improve the underlying detection logic.