<?xml version="1.0" encoding="utf-8"?>
<TEI xmlns="http://www.tei-c.org/ns/1.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:hal="http://hal.archives-ouvertes.fr/" xmlns:gml="http://www.opengis.net/gml/3.3/" xmlns:gmlce="http://www.opengis.net/gml/3.3/ce" version="1.1" xsi:schemaLocation="http://www.tei-c.org/ns/1.0 http://api.archives-ouvertes.fr/documents/aofr-sword.xsd">
  <teiHeader>
    <fileDesc>
      <titleStmt>
        <title>HAL TEI export of hal-04099618</title>
      </titleStmt>
      <publicationStmt>
        <distributor>CCSD</distributor>
        <availability status="restricted">
          <licence target="https://creativecommons.org/publicdomain/zero/1.0/">CC0 1.0 - Universal</licence>
        </availability>
        <date when="2026-05-22T14:45:58+02:00"/>
      </publicationStmt>
      <sourceDesc>
        <p part="N">HAL API Platform</p>
      </sourceDesc>
    </fileDesc>
  </teiHeader>
  <text>
    <body>
      <listBibl>
        <biblFull>
          <titleStmt>
            <title xml:lang="en">A Survey on Malware Detection with Graph Representation Learning</title>
            <author role="aut">
              <persName>
                <forename type="first">Tristan</forename>
                <surname>Bilot</surname>
              </persName>
              <email type="md5">c991bb2f3a19afa0ba9e3700f5c54a17</email>
              <email type="domain">hotmail.fr</email>
              <idno type="idhal" notation="string">tristan-bilot</idno>
              <idno type="idhal" notation="numeric">1255093</idno>
              <idno type="halauthorid" notation="string">2813758-1255093</idno>
              <idno type="ORCID">https://orcid.org/0000-0003-4153-735X</idno>
              <idno type="IDREF">https://www.idref.fr/293248400</idno>
              <affiliation ref="#struct-1162716"/>
              <affiliation ref="#struct-1061259"/>
              <affiliation ref="#struct-143142"/>
            </author>
            <author role="aut">
              <persName>
                <forename type="first">Nour</forename>
                <surname>El Madhoun</surname>
              </persName>
              <email type="md5">888df833e9d4e3996b5cdd70d1899330</email>
              <email type="domain">lip6.fr</email>
              <idno type="idhal" notation="string">nour-el-madhoun</idno>
              <idno type="idhal" notation="numeric">6562</idno>
              <idno type="halauthorid" notation="string">46256-6562</idno>
              <idno type="ORCID">https://orcid.org/0000-0001-7742-7748</idno>
              <idno type="IDREF">https://www.idref.fr/241991765</idno>
              <affiliation ref="#struct-143142"/>
              <affiliation ref="#struct-413221"/>
            </author>
            <author role="aut">
              <persName>
                <forename type="first">Khaldoun Al</forename>
                <surname>Agha</surname>
              </persName>
              <email type="md5">8024940c2926c6e171f496871a475df9</email>
              <email type="domain">lri.fr</email>
              <idno type="idhal" notation="numeric">1276988</idno>
              <idno type="halauthorid" notation="string">1344548-1276988</idno>
              <idno type="ORCID">https://orcid.org/0000-0002-6595-5866</idno>
              <idno type="IDREF">https://www.idref.fr/058873252</idno>
              <idno type="ISNI">http://isni.org/isni/0000000117102175</idno>
              <idno type="VIAF">https://viaf.org/viaf/162540920</idno>
              <affiliation ref="#struct-1061259"/>
            </author>
            <author role="aut">
              <persName>
                <forename type="first">Anis</forename>
                <surname>Zouaoui</surname>
              </persName>
              <idno type="halauthorid">2813759-0</idno>
              <affiliation ref="#struct-1162716"/>
            </author>
            <editor role="depositor">
              <persName>
                <forename>Nour</forename>
                <surname>EL MADHOUN</surname>
              </persName>
              <email type="md5">4d3e8794df9970d20c2f98d2297e8b2b</email>
              <email type="domain">isep.fr</email>
            </editor>
          </titleStmt>
          <editionStmt>
            <edition n="v1" type="current">
              <date type="whenSubmitted">2023-05-17 08:42:57</date>
              <date type="whenWritten">2023-03-28</date>
              <date type="whenModified">2026-02-05 14:16:07</date>
              <date type="whenReleased">2023-05-19 12:56:44</date>
              <date type="whenProduced">2023-03-28</date>
              <date type="whenEndEmbargoed">2023-05-17</date>
              <ref type="file" target="https://hal.science/hal-04099618v1/document">
                <date notBefore="2023-05-17"/>
              </ref>
              <ref type="file" subtype="author" n="1" target="https://hal.science/hal-04099618v1/file/2303.16004.pdf" id="file-4099618-3569257">
                <date notBefore="2023-05-17"/>
              </ref>
              <ref type="externalLink" target="http://arxiv.org/pdf/2303.16004"/>
            </edition>
            <respStmt>
              <resp>contributor</resp>
              <name key="326358">
                <persName>
                  <forename>Nour</forename>
                  <surname>EL MADHOUN</surname>
                </persName>
                <email type="md5">4d3e8794df9970d20c2f98d2297e8b2b</email>
                <email type="domain">isep.fr</email>
              </name>
            </respStmt>
          </editionStmt>
          <publicationStmt>
            <distributor>CCSD</distributor>
            <idno type="halId">hal-04099618</idno>
            <idno type="halUri">https://hal.science/hal-04099618</idno>
            <idno type="halBibtex">bilot:hal-04099618</idno>
            <idno type="halRefHtml">2023</idno>
            <idno type="halRef">2023</idno>
            <availability status="restricted">
              <licence target="https://about.hal.science/hal-authorisation-v1/">HAL Authorization<ref corresp="#file-4099618-3569257"/></licence>
            </availability>
          </publicationStmt>
          <seriesStmt>
            <idno type="stamp" n="CNRS">CNRS - Centre national de la recherche scientifique</idno>
            <idno type="stamp" n="CENTRALESUPELEC">Ecole CentraleSupélec</idno>
            <idno type="stamp" n="UNIV-PARIS-SACLAY">Université Paris-Saclay</idno>
            <idno type="stamp" n="SORBONNE-UNIVERSITE">Sorbonne Université</idno>
            <idno type="stamp" n="SORBONNE-UNIV" corresp="SORBONNE-UNIVERSITE">Sorbonne Université 01/01/2018</idno>
            <idno type="stamp" n="UNIVERSITE-PARIS-SACLAY" corresp="UNIV-PARIS-SACLAY">Université Paris-Saclay</idno>
            <idno type="stamp" n="SU-TI">Sorbonne Université - Texte Intégral</idno>
            <idno type="stamp" n="LISN">Laboratoire Interdisciplinaire des Sciences du Numérique</idno>
            <idno type="stamp" n="GS-COMPUTER-SCIENCE">Graduate School Computer Science</idno>
            <idno type="stamp" n="LISN-ROCS" corresp="LISN">Réseaux &amp; Optimisation Combinatoire et Stochastique </idno>
            <idno type="stamp" n="ALLIANCE-SU"> Alliance Sorbonne Université</idno>
            <idno type="stamp" n="ISEP">Institut supérieur d'électronique de Paris</idno>
          </seriesStmt>
          <notesStmt>
            <note type="commentary">Preprint, submitted to ACM Computing Surveys on March 2023. For any suggestions or improvements, please contact me directly by e-mail</note>
          </notesStmt>
          <sourceDesc>
            <biblStruct>
              <analytic>
                <title xml:lang="en">A Survey on Malware Detection with Graph Representation Learning</title>
                <author role="aut">
                  <persName>
                    <forename type="first">Tristan</forename>
                    <surname>Bilot</surname>
                  </persName>
                  <email type="md5">c991bb2f3a19afa0ba9e3700f5c54a17</email>
                  <email type="domain">hotmail.fr</email>
                  <idno type="idhal" notation="string">tristan-bilot</idno>
                  <idno type="idhal" notation="numeric">1255093</idno>
                  <idno type="halauthorid" notation="string">2813758-1255093</idno>
                  <idno type="ORCID">https://orcid.org/0000-0003-4153-735X</idno>
                  <idno type="IDREF">https://www.idref.fr/293248400</idno>
                  <affiliation ref="#struct-1162716"/>
                  <affiliation ref="#struct-1061259"/>
                  <affiliation ref="#struct-143142"/>
                </author>
                <author role="aut">
                  <persName>
                    <forename type="first">Nour</forename>
                    <surname>El Madhoun</surname>
                  </persName>
                  <email type="md5">888df833e9d4e3996b5cdd70d1899330</email>
                  <email type="domain">lip6.fr</email>
                  <idno type="idhal" notation="string">nour-el-madhoun</idno>
                  <idno type="idhal" notation="numeric">6562</idno>
                  <idno type="halauthorid" notation="string">46256-6562</idno>
                  <idno type="ORCID">https://orcid.org/0000-0001-7742-7748</idno>
                  <idno type="IDREF">https://www.idref.fr/241991765</idno>
                  <affiliation ref="#struct-143142"/>
                  <affiliation ref="#struct-413221"/>
                </author>
                <author role="aut">
                  <persName>
                    <forename type="first">Khaldoun Al</forename>
                    <surname>Agha</surname>
                  </persName>
                  <email type="md5">8024940c2926c6e171f496871a475df9</email>
                  <email type="domain">lri.fr</email>
                  <idno type="idhal" notation="numeric">1276988</idno>
                  <idno type="halauthorid" notation="string">1344548-1276988</idno>
                  <idno type="ORCID">https://orcid.org/0000-0002-6595-5866</idno>
                  <idno type="IDREF">https://www.idref.fr/058873252</idno>
                  <idno type="ISNI">http://isni.org/isni/0000000117102175</idno>
                  <idno type="VIAF">https://viaf.org/viaf/162540920</idno>
                  <affiliation ref="#struct-1061259"/>
                </author>
                <author role="aut">
                  <persName>
                    <forename type="first">Anis</forename>
                    <surname>Zouaoui</surname>
                  </persName>
                  <idno type="halauthorid">2813759-0</idno>
                  <affiliation ref="#struct-1162716"/>
                </author>
              </analytic>
              <monogr>
                <imprint>
                  <date type="datePub">2023-03-28</date>
                </imprint>
              </monogr>
              <idno type="arxiv">2303.16004</idno>
            </biblStruct>
          </sourceDesc>
          <profileDesc>
            <langUsage>
              <language ident="en">English</language>
            </langUsage>
            <textClass>
              <keywords scheme="author">
                <term xml:lang="en">Graph Representation Learning</term>
                <term xml:lang="en">ML</term>
                <term xml:lang="en">Deep Learning</term>
                <term xml:lang="en">Deep Learning DL GNN Graph Neural Networks Graph Representation Learning Machine Learning Malware Malware Detection ML</term>
                <term xml:lang="en">ML.</term>
                <term xml:lang="en">Malware Detection</term>
                <term xml:lang="en">Malware</term>
                <term xml:lang="en">Machine Learning</term>
                <term xml:lang="en">Graph Neural Networks</term>
                <term xml:lang="en">GNN</term>
                <term xml:lang="en">DL</term>
              </keywords>
              <classCode scheme="halDomain" n="info.info-ai">Computer Science [cs]/Artificial Intelligence [cs.AI]</classCode>
              <classCode scheme="halDomain" n="info.info-cr">Computer Science [cs]/Cryptography and Security [cs.CR]</classCode>
              <classCode scheme="halTypology" n="UNDEFINED">Preprints, Working Papers, ...</classCode>
              <classCode scheme="halOldTypology" n="UNDEFINED">Preprints, Working Papers, ...</classCode>
              <classCode scheme="halTreeTypology" n="UNDEFINED">Preprints, Working Papers, ...</classCode>
            </textClass>
            <abstract xml:lang="en">
              <p>Malware detection has become a major concern due to the increasing number and complexity of malware. Traditional detection methods based on signatures and heuristics are used for malware detection, but unfortunately, they suffer from poor generalization to unknown attacks and can be easily circumvented using obfuscation techniques. In recent years, Machine Learning (ML) and notably Deep Learning (DL) achieved impressive results in malware detection by learning useful representations from data and have become a solution preferred over traditional methods. More recently, the application of such techniques on graph-structured data has achieved state-of-the-art performance in various domains and demonstrates promising results in learning more robust representations from malware. Yet, no literature review focusing on graph-based deep learning for malware detection exists. In this survey, we provide an in-depth literature review to summarize and unify existing works under the common approaches and architectures. We notably demonstrate that Graph Neural Networks (GNNs) reach competitive results in learning robust embeddings from malware represented as expressive graph structures, leading to an efficient detection by downstream classifiers. This paper also reviews adversarial attacks that are utilized to fool graph-based detection methods. Challenges and future research directions are discussed at the end of the paper. CCS Concepts: • General and reference → Surveys and overviews; • Security and privacy → Malware and its mitigation; • Computing methodologies → Learning latent representations; Neural networks; Spectral methods.</p>
            </abstract>
          </profileDesc>
        </biblFull>
      </listBibl>
    </body>
    <back>
      <listOrg type="structures">
        <org type="institution" xml:id="struct-1162716" status="VALID">
          <orgName>Iriguard</orgName>
          <desc>
            <address>
              <addrLine>Campus Cyber5-7 rue Bellini92800 La Défense</addrLine>
              <country key="FR"/>
            </address>
            <ref type="url">https://www.iriguard.com/</ref>
          </desc>
        </org>
        <org type="laboratory" xml:id="struct-1061259" status="VALID">
          <idno type="IdRef">253160316</idno>
          <idno type="RNSR">202123711L</idno>
          <idno type="ROR">https://ror.org/00rd81916</idno>
          <idno type="Wikidata">Q109620676</idno>
          <orgName>Laboratoire Interdisciplinaire des Sciences du Numérique</orgName>
          <orgName type="acronym">LISN</orgName>
          <date type="start">2021-01-01</date>
          <desc>
            <address>
              <addrLine>Campus Universitaire bât 507Rue du Belvédère91405 Orsay cedexet Campus Universitaire bât 6401 rue Raimond Castaing91190 Gif-sur-Yvette</addrLine>
              <country key="FR"/>
            </address>
            <ref type="url">https://www.lisn.upsaclay.fr/</ref>
          </desc>
          <listRelation>
            <relation active="#struct-300009" type="direct"/>
            <relation active="#struct-411575" type="direct"/>
            <relation active="#struct-419361" type="direct"/>
            <relation name="UMR9015" active="#struct-441569" type="direct"/>
          </listRelation>
        </org>
        <org type="laboratory" xml:id="struct-143142" status="VALID">
          <orgName>Laboratoire d'Informatique, Signal et Image, Electronique et Télécommunication</orgName>
          <orgName type="acronym">LISITE</orgName>
          <desc>
            <address>
              <country key="FR"/>
            </address>
            <ref type="url">http://www.isep.fr/recherche-academique</ref>
          </desc>
          <listRelation>
            <relation active="#struct-95837" type="direct"/>
          </listRelation>
        </org>
        <org type="regroupinstitution" xml:id="struct-413221" status="VALID">
          <idno type="IdRef">221333754</idno>
          <idno type="ROR">https://ror.org/02en5vm52</idno>
          <orgName>Sorbonne Université</orgName>
          <orgName type="acronym">SU</orgName>
          <date type="start">2018-01-01</date>
          <desc>
            <address>
              <addrLine>21 rue de l’École de médecine - 75006 Paris</addrLine>
              <country key="FR"/>
            </address>
            <ref type="url">http://www.sorbonne-universite.fr/</ref>
          </desc>
        </org>
        <org type="institution" xml:id="struct-300009" status="VALID">
          <idno type="ROR">https://ror.org/02kvxyf05</idno>
          <orgName>Institut National de Recherche en Informatique et en Automatique</orgName>
          <orgName type="acronym">Inria</orgName>
          <desc>
            <address>
              <addrLine>Domaine de VoluceauRocquencourt - BP 10578153 Le Chesnay Cedex</addrLine>
              <country key="FR"/>
            </address>
            <ref type="url">http://www.inria.fr/en/</ref>
          </desc>
        </org>
        <org type="institution" xml:id="struct-411575" status="VALID">
          <idno type="IdRef">184443237</idno>
          <idno type="ROR">https://ror.org/019tcpt25</idno>
          <orgName>CentraleSupélec</orgName>
          <desc>
            <address>
              <addrLine>3, rue Joliot Curie,Plateau de Moulon,91192 GIF-SUR-YVETTE Cedex</addrLine>
              <country key="FR"/>
            </address>
            <ref type="url">http://www.centralesupelec.fr</ref>
          </desc>
        </org>
        <org type="institution" xml:id="struct-419361" status="VALID">
          <idno type="IdRef">241345251</idno>
          <idno type="ROR">https://ror.org/03xjwb503</idno>
          <orgName>Université Paris-Saclay</orgName>
          <desc>
            <address>
              <addrLine>Bâtiment Bréguet, 3 Rue Joliot Curie 2e ét, 91190 Gif-sur-Yvette</addrLine>
              <country key="FR"/>
            </address>
            <ref type="url">https://www.universite-paris-saclay.fr/fr</ref>
          </desc>
        </org>
        <org type="regroupinstitution" xml:id="struct-441569" status="VALID">
          <idno type="IdRef">02636817X</idno>
          <idno type="ISNI">0000000122597504</idno>
          <idno type="ROR">https://ror.org/02feahw73</idno>
          <orgName>Centre National de la Recherche Scientifique</orgName>
          <orgName type="acronym">CNRS</orgName>
          <date type="start">1939-10-19</date>
          <desc>
            <address>
              <country key="FR"/>
            </address>
            <ref type="url">https://www.cnrs.fr/</ref>
          </desc>
        </org>
        <org type="institution" xml:id="struct-95837" status="VALID">
          <idno type="ROR">https://ror.org/00yw34h52</idno>
          <orgName>Institut Supérieur d'Electronique de Paris</orgName>
          <orgName type="acronym">ISEP</orgName>
          <desc>
            <address>
              <addrLine>28 Rue Notre Dame des Champs 75006 Paris</addrLine>
              <country key="FR"/>
            </address>
            <ref type="url">http://www.isep.fr</ref>
          </desc>
        </org>
      </listOrg>
    </back>
  </text>
</TEI>