Better Call Graphs: A New Dataset of Function Call Graphs for Malware Classification

2025-12-23

AI Summary

Existing Android function call graph (FCG) datasets suffer from obsolescence, limited scale, high redundancy, and insufficient coverage of malicious samples, leading to overfitting and unreliable evaluation of graph neural networks (GNNs) for malware classification. To address this, we propose a systematic static analysis pipeline that leverages decompilation and component-level control-flow parsing to extract structurally rich, temporally up-to-date, and rigorously deduplicated FCGs. Based on this pipeline, we introduce AndroFCG—the first large-scale, high-quality, Android-specific FCG benchmark dataset—comprising diverse benign and malicious APKs along with comprehensive graph-level statistical features. Extensive experiments demonstrate that AndroFCG significantly improves the generalizability and robustness of both GNNs and traditional graph classifiers while effectively mitigating overfitting. All data and source code are publicly released to foster reproducible research.

Technology Category

• Machine Learning: Graph-based Machine Learning
• Natural Language Processing: Fact-Checking / Misinformation Detection (NLP Focus)
• Data Mining & Knowledge Management: Graph Mining, Social Network Analysis & Community

Application Category

• Graph Algorithms and Modeling for the Web: Efficient manipulation of static and dynamic Web-related graphs
• Web Mining and Content Analysis: Large pretrained models with web data
• Economics, Online Markets and Human Computation: Data quality aspects of human-annotated datasets

Abstract

Function call graphs (FCGs) have emerged as a powerful abstraction for malware detection, capturing the behavioral structure of applications beyond surface-level signatures. Their utility in traditional program analysis has been well established, enabling effective classification and analysis of malicious software. In the mobile domain, especially in the Android ecosystem, FCG-based malware classification is particularly critical due to the platform's widespread adoption and the complex, component-based structure of Android apps. However, progress in this direction is hindered by the lack of large-scale, high-quality Android-specific FCG datasets. Existing datasets are often outdated, dominated by small or redundant graphs resulting from app repackaging, and fail to reflect the diversity of real-world malware. These limitations lead to overfitting and unreliable evaluation of graph-based classification methods. To address this gap, we introduce Better Call Graphs (BCG), a comprehensive dataset of large and unique FCGs extracted from recent Android application packages (APKs). BCG includes both benign and malicious samples spanning various families and types, along with graph-level features for each APK. Through extensive experiments using baseline classifiers, we demonstrate the necessity and value of BCG compared to existing datasets. BCG is publicly available at https://erdemub.github.io/BCG-dataset.

Problem

• Lack of large-scale, high-quality Android-specific function call graph datasets
• Existing datasets are outdated, redundant, and lack real-world malware diversity
• These limitations cause overfitting and unreliable evaluation of classification methods

Innovation

• Introduces BCG dataset for Android malware classification
• Provides large unique function call graphs from recent APKs
• Includes diverse benign and malicious samples with graph features