Malware Classification Using Dynamic Cluster Adaptive Aggregation Graph Neural Network with Prototypical Loss Function

Malware classification is the process of categorizing malicious software into specific families based on its structural and behavioral features. However, malware classification remains challenging due to high code similarity across different families, leading to suboptimal performance. To address this issue, this research proposes a Dynamic Cluster Adaptive Aggregation Graph Neural Network with Prototypical Loss Function (DCAAGNN-PLF) for effective malware classification. DCAA is incorporated in the GNN to adaptively group similar nodes that effectively capture both global and local structural variations. PLF ensures robust intra-class clustering while enhancing inter-class separation in the feature space that minimizes misclassification. Min-max normalization scales all features to a common range that avoids larger numerical values and enhances model performance. Therefore, the proposed DCAAGNN-PLF achieves better accuracies of 99.90% and 99.25% on the Malimg dataset and the Microsoft BIG2015 dataset, respectively, compared to existing techniques such as Convolutional Neural Network (ConvNet).