Graph-based malware analysis has been held back by its datasets rather than by its models. A program gets flattened into a single graph, and the relationship between what a program does and how it does it disappears in the process. Detectors trained on that representation learn surface patterns, which is why they age badly against obfuscation and against malware that simply moves on.
HiGraph keeps both levels. Every application is a function call graph, and every node in it opens into the control flow graph of that function. Interprocedural behaviour and instruction-level logic stay in the same object, so a model can be asked which one it is actually relying on.
What is in it
| Control flow graphs | over 200 million |
| Function call graphs | 499,981 |
| Malicious applications | 50,661 |
| Benign applications | 449,320 |
| Malware families | 683 |
| Time span | 2012 to 2022 |
Ten years matters more than the totals do. A dataset drawn from a single year measures how well a detector fits that year; a decade lets you train on the past and test on the future, which is the only question a deployed detector is ever asked.
Alongside the data there is an extraction pipeline, reference loaders, baseline training scripts, and a benchmarking harness, so a result can be reproduced rather than described. The explorer opens a single sample in the browser and lets you drill from the call graph into any function’s control flow, which is the fastest way to see what the two levels actually look like.
Where it came from
The dataset began as infrastructure for our own work and turned out to be the contribution. Publishing it is the point: the analysis in the paper shows that benign and malicious software differ structurally at both levels, but that finding is an argument for the representation, not the end of it.
Authors. Han Chen, Hanchen Wang, Hongmei Chen, Ying Zhang, Lu Qin, Wenjie Zhang. University of Technology Sydney, Yunnan University, and UNSW.