Graph Neural Networks for Malware and Financial Fraud Detection

Abstract

Malware and payment fraud share a structural feature that flat feature vectors throw away. Both leave behind a graph. A binary induces a call graph; a fraud ring induces a web of accounts, devices and shared attributes. Graph neural networks learn on that structure directly, and this review examines what the move has bought in each domain. We cover thirty two works. The modelling machinery turns out to be common to both problems, while the graph construction step, which is where most of the engineering effort goes, is not. Three obstacles recur and none is solved. Fraud graphs are extremely imbalanced, so the majority class dominates the message passing. Adversaries adapt, and camouflage that connects a fraudulent node to legitimate neighbours defeats naive aggregation. And evaluation protocols that ignore time leak future information into training, which inflates reported accuracy in ways that field deployment does not reproduce. We set out what a defensible evaluation looks like and where the research gaps sit.