{"id":"https://openalex.org/W3134204681","doi":"https://doi.org/10.1145/3468791.3468814","title":"NF-GNN: Network Flow Graph Neural Networks for Malware Detection and Classification","display_name":"NF-GNN: Network Flow Graph Neural Networks for Malware Detection and Classification","publication_year":2021,"publication_date":"2021-07-06","ids":{"openalex":"https://openalex.org/W3134204681","doi":"https://doi.org/10.1145/3468791.3468814","mag":"3134204681"},"language":"en","primary_location":{"id":"doi:10.1145/3468791.3468814","is_oa":false,"landing_page_url":"https://doi.org/10.1145/3468791.3468814","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"33rd International Conference on Scientific and Statistical Database Management","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["arxiv","crossref"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://arxiv.org/pdf/2103.03939","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5026360751","display_name":"Julian Busch","orcid":null},"institutions":[{"id":"https://openalex.org/I3018771216","display_name":"LMU Klinikum","ror":"https://ror.org/02jet3w32","country_code":"DE","type":"healthcare","lineage":["https://openalex.org/I3018771216","https://openalex.org/I8204097"]},{"id":"https://openalex.org/I8204097","display_name":"Ludwig-Maximilians-Universit\u00e4t M\u00fcnchen","ror":"https://ror.org/05591te55","country_code":"DE","type":"education","lineage":["https://openalex.org/I8204097"]}],"countries":["DE"],"is_corresponding":false,"raw_author_name":"Julian Busch","raw_affiliation_strings":["LMU Munich"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"LMU Munich","institution_ids":["https://openalex.org/I3018771216","https://openalex.org/I8204097"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5052598260","display_name":"Anton Kocheturov","orcid":"https://orcid.org/0000-0003-2549-9146"},"institutions":[{"id":"https://openalex.org/I1325886976","display_name":"Siemens (Germany)","ror":"https://ror.org/059mq0909","country_code":"DE","type":"company","lineage":["https://openalex.org/I1325886976"]}],"countries":["DE"],"is_corresponding":false,"raw_author_name":"Anton Kocheturov","raw_affiliation_strings":["Siemens Technology"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Siemens Technology","institution_ids":["https://openalex.org/I1325886976"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5074808403","display_name":"Volker Tresp","orcid":"https://orcid.org/0000-0001-9428-3686"},"institutions":[{"id":"https://openalex.org/I1325886976","display_name":"Siemens (Germany)","ror":"https://ror.org/059mq0909","country_code":"DE","type":"company","lineage":["https://openalex.org/I1325886976"]}],"countries":["DE"],"is_corresponding":false,"raw_author_name":"Volker Tresp","raw_affiliation_strings":["Siemens AG"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Siemens AG","institution_ids":["https://openalex.org/I1325886976"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5003335849","display_name":"Thomas Seidl","orcid":"https://orcid.org/0000-0002-4861-1412"},"institutions":[{"id":"https://openalex.org/I3018771216","display_name":"LMU Klinikum","ror":"https://ror.org/02jet3w32","country_code":"DE","type":"healthcare","lineage":["https://openalex.org/I3018771216","https://openalex.org/I8204097"]},{"id":"https://openalex.org/I8204097","display_name":"Ludwig-Maximilians-Universit\u00e4t M\u00fcnchen","ror":"https://ror.org/05591te55","country_code":"DE","type":"education","lineage":["https://openalex.org/I8204097"]}],"countries":["DE"],"is_corresponding":false,"raw_author_name":"Thomas Seidl","raw_affiliation_strings":["LMU Munich"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"LMU Munich","institution_ids":["https://openalex.org/I3018771216","https://openalex.org/I8204097"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":3,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":14.9193,"has_fulltext":false,"cited_by_count":76,"citation_normalized_percentile":{"value":0.99676424,"is_in_top_1_percent":true,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":89,"max":100},"biblio":{"volume":null,"issue":null,"first_page":"121","last_page":"132"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9998000264167786,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9998000264167786,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9997000098228455,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11512","display_name":"Anomaly Detection Techniques and Applications","score":0.9961000084877014,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/malware","display_name":"Malware","score":0.9077812433242798},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.7960253357887268},{"id":"https://openalex.org/keywords/leverage","display_name":"Leverage (statistics)","score":0.7183932065963745},{"id":"https://openalex.org/keywords/margin","display_name":"Margin (machine learning)","score":0.5421972274780273},{"id":"https://openalex.org/keywords/data-mining","display_name":"Data mining","score":0.5151787996292114},{"id":"https://openalex.org/keywords/mobile-malware","display_name":"Mobile malware","score":0.5089066028594971},{"id":"https://openalex.org/keywords/machine-learning","display_name":"Machine learning","score":0.5075432062149048},{"id":"https://openalex.org/keywords/artificial-neural-network","display_name":"Artificial neural network","score":0.49814534187316895},{"id":"https://openalex.org/keywords/graph","display_name":"Graph","score":0.47753798961639404},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.4617723226547241},{"id":"https://openalex.org/keywords/flow-network","display_name":"Flow network","score":0.4104982614517212},{"id":"https://openalex.org/keywords/theoretical-computer-science","display_name":"Theoretical computer science","score":0.17676344513893127},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.1405496895313263}],"concepts":[{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.9077812433242798},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7960253357887268},{"id":"https://openalex.org/C153083717","wikidata":"https://www.wikidata.org/wiki/Q6535263","display_name":"Leverage (statistics)","level":2,"score":0.7183932065963745},{"id":"https://openalex.org/C774472","wikidata":"https://www.wikidata.org/wiki/Q6760393","display_name":"Margin (machine learning)","level":2,"score":0.5421972274780273},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.5151787996292114},{"id":"https://openalex.org/C2780967490","wikidata":"https://www.wikidata.org/wiki/Q1291200","display_name":"Mobile malware","level":3,"score":0.5089066028594971},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.5075432062149048},{"id":"https://openalex.org/C50644808","wikidata":"https://www.wikidata.org/wiki/Q192776","display_name":"Artificial neural network","level":2,"score":0.49814534187316895},{"id":"https://openalex.org/C132525143","wikidata":"https://www.wikidata.org/wiki/Q141488","display_name":"Graph","level":2,"score":0.47753798961639404},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.4617723226547241},{"id":"https://openalex.org/C114809511","wikidata":"https://www.wikidata.org/wiki/Q1412924","display_name":"Flow network","level":2,"score":0.4104982614517212},{"id":"https://openalex.org/C80444323","wikidata":"https://www.wikidata.org/wiki/Q2878974","display_name":"Theoretical computer science","level":1,"score":0.17676344513893127},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.1405496895313263},{"id":"https://openalex.org/C33923547","wikidata":"https://www.wikidata.org/wiki/Q395","display_name":"Mathematics","level":0,"score":0.0},{"id":"https://openalex.org/C126255220","wikidata":"https://www.wikidata.org/wiki/Q141495","display_name":"Mathematical optimization","level":1,"score":0.0}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.1145/3468791.3468814","is_oa":false,"landing_page_url":"https://doi.org/10.1145/3468791.3468814","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"33rd International Conference on Scientific and Statistical Database Management","raw_type":"proceedings-article"},{"id":"pmh:oai:arXiv.org:2103.03939","is_oa":true,"landing_page_url":"http://arxiv.org/abs/2103.03939","pdf_url":"https://arxiv.org/pdf/2103.03939","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"}],"best_oa_location":{"id":"pmh:oai:arXiv.org:2103.03939","is_oa":true,"landing_page_url":"http://arxiv.org/abs/2103.03939","pdf_url":"https://arxiv.org/pdf/2103.03939","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":52,"referenced_works":["https://openalex.org/W1553801604","https://openalex.org/W1970088130","https://openalex.org/W1973403081","https://openalex.org/W2005662348","https://openalex.org/W2085562432","https://openalex.org/W2182464523","https://openalex.org/W2194775991","https://openalex.org/W2282861635","https://openalex.org/W2343828539","https://openalex.org/W2519887557","https://openalex.org/W2558748708","https://openalex.org/W2601305972","https://openalex.org/W2604314403","https://openalex.org/W2606202972","https://openalex.org/W2606780347","https://openalex.org/W2747329762","https://openalex.org/W2780618540","https://openalex.org/W2785720803","https://openalex.org/W2787337315","https://openalex.org/W2803697594","https://openalex.org/W2804057010","https://openalex.org/W2804368608","https://openalex.org/W2805516822","https://openalex.org/W2906631928","https://openalex.org/W2907492528","https://openalex.org/W2909482470","https://openalex.org/W2910068345","https://openalex.org/W2916106175","https://openalex.org/W2950697450","https://openalex.org/W2952254971","https://openalex.org/W2961850650","https://openalex.org/W2962711740","https://openalex.org/W2963464736","https://openalex.org/W2963858333","https://openalex.org/W2964015378","https://openalex.org/W2964114465","https://openalex.org/W2964124573","https://openalex.org/W2973511309","https://openalex.org/W2981859286","https://openalex.org/W2982413766","https://openalex.org/W2996806689","https://openalex.org/W3003585926","https://openalex.org/W3010397017","https://openalex.org/W3012889073","https://openalex.org/W3023107948","https://openalex.org/W3039501033","https://openalex.org/W3042454706","https://openalex.org/W3080525460","https://openalex.org/W3090863228","https://openalex.org/W3093002101","https://openalex.org/W4210257598","https://openalex.org/W4297733535"],"related_works":["https://openalex.org/W2538622067","https://openalex.org/W2181494682","https://openalex.org/W4245250093","https://openalex.org/W3114159050","https://openalex.org/W2484248966","https://openalex.org/W4244354662","https://openalex.org/W4200054778","https://openalex.org/W2777464647","https://openalex.org/W2965539362","https://openalex.org/W2717179875"],"abstract_inverted_index":{"Malicious":[0],"software":[1],"(malware)":[2],"poses":[3],"an":[4],"increasing":[5],"threat":[6],"to":[7,47],"the":[8,14,54,130],"security":[9],"of":[10,16,41,80,132],"communication":[11,50],"systems":[12],"as":[13],"number":[15],"interconnected":[17],"mobile":[18,111],"devices":[19],"increases":[20],"exponentially.":[21],"While":[22],"some":[23],"existing":[24],"malware":[25,86,112],"detection":[26,87,113,145],"and":[27,44,63,88,92,135],"classification":[28,89],"approaches":[29],"successfully":[30],"leverage":[31,48],"network":[32,37,74,141],"traffic":[33],"data,":[34],"they":[35],"treat":[36],"flows":[38],"between":[39],"pairs":[40],"endpoints":[42],"independently":[43],"thus":[45],"fail":[46],"rich":[49],"patterns":[51],"present":[52,77],"in":[53,90],"complete":[55],"network.":[56],"Our":[57],"approach":[58,98,134],"first":[59],"extracts":[60],"flow":[61,100],"graphs":[62,101],"subsequently":[64],"classifies":[65],"them":[66],"using":[67],"a":[68,106,148],"novel":[69],"edge":[70],"feature-based":[71],"graph":[72,139],"neural":[73,140],"model.":[75],"We":[76,95],"three":[78],"variants":[79],"our":[81,97,133,138],"base":[82],"model,":[83],"which":[84],"support":[85],"supervised":[91],"unsupervised":[93],"settings.":[94],"evaluate":[96],"on":[99,123],"that":[102,114,137],"we":[103],"extract":[104],"from":[105],"recently":[107],"published":[108],"dataset":[109],"for":[110],"addresses":[115],"several":[116],"issues":[117],"with":[118],"previously":[119],"available":[120],"datasets.":[121],"Experiments":[122],"four":[124],"different":[125],"prediction":[126],"tasks":[127],"consistently":[128],"demonstrate":[129],"advantages":[131],"show":[136],"model":[142],"can":[143],"boost":[144],"performance":[146],"by":[147],"significant":[149],"margin.":[150]},"counts_by_year":[{"year":2026,"cited_by_count":7},{"year":2025,"cited_by_count":14},{"year":2024,"cited_by_count":23},{"year":2023,"cited_by_count":17},{"year":2022,"cited_by_count":14},{"year":2021,"cited_by_count":1}],"updated_date":"2026-08-11T07:18:39.950985","created_date":"2025-10-10T00:00:00"}