HSD-GNN: An Explainability-guided Hybrid Static-dynamic Graph Neural Network for Intelligent Malware Detection

The rapid evolution of malware and its use of obfuscation, polymorphism, and code reuse have rendered traditional detection mechanisms inadequate.Recent deep-learning and graph-based methods demonstrate strong potential but often rely on single-source features, topology-only reduction, and post-hoc explainability, limiting robustness and interpretability.This paper introduces a novel Hybrid Static-Dynamic Semantic Graph Neural Network (HSD-GNN) designed to unify structural and behavioral representations for explainable malware detection.The framework integrates Control Flow Graphs (CFGs), Function Call Graphs (FCGs), and Behavior Graphs (BGs) into a unified hybrid structure, employs a Semantic-Aware Graph Reduction (SAGR) mechanism for informationpreserving pruning, and incorporates an Explainability-Guided Learning (EGL) feedback loop that links interpretability with model optimization.Experimental evaluations on BODMAS, Dike Dataset, and PMML demonstrate superior accuracy (98.4%), reduced model size (-25%), and high explainability fidelity (91.7%) compared with recent GNN-based detectors.Statistical and cross-dataset validation confirm the stability and generalization of the proposed approach.Overall, HSD-GNN establishes a scalable and interpretable paradigm for next-generation malware detection, advancing the integration of graph learning and explainable artificial intelligence in cybersecurity.