HiGraph: Hierarchical Malware Analysis

• HiGraph is a hierarchical graph dataset that organizes Android apps as two-level structures combining global Function Call Graphs (FCGs) and local Control Flow Graphs (CFGs).
• It addresses the limitations of flat graph models by preserving the interplay between high-level functional architecture and low-level execution logic.
• The dataset’s scale and detailed annotations support robust GNN-based malware detection research, particularly under concept drift and code obfuscation.

HiGraph is a large-scale hierarchical graph dataset for Android malware analysis that models each application as a two-level “graph of graphs”: a global Function Call Graph (FCG) whose local-function nodes contain Control Flow Graphs (CFGs). It was introduced to address a central limitation of prior graph-based malware corpora, namely the reduction of programs to single-level graphs that do not preserve the interaction between high-level functional structure and low-level instruction logic. HiGraph comprises over 200M CFGs nested within 595K FCGs, and is presented as the largest public hierarchical graph dataset for malware analysis, with public data and tooling released at https://higraph.org (Chen et al., 2 Sep 2025).

1. Motivation and problem setting

HiGraph was developed against the background that graph-based malware analysis, particularly with GNNs, has been constrained by the absence of datasets that capture the inherent hierarchical structure of software. Existing datasets are described as “flat” single-level graphs, which miss the interplay between intra-procedural behavior and inter-procedural organization. In the HiGraph formulation, this omission is consequential because malware detection must contend with malware evolution and code obfuscation, both of which can alter surface-level structure while preserving deeper semantic organization (Chen et al., 2 Sep 2025).

The dataset therefore treats hierarchy not as an auxiliary annotation but as the primary representational principle. The intended gain is semantic preservation across two complementary scales: architecture-level behavior through function interactions, and logic-level behavior through basic-block control flow. A common misconception in this area is that richer malware representation mainly requires larger graphs. HiGraph instead emphasizes that the issue is representational granularity: a single large graph can still collapse distinctions between global calling structure and local execution logic.

2. Hierarchical data model

For each Android application, HiGraph extracts a function call graph

$\mathcal{G} = (\mathcal{V}, \mathcal{E}),$

where $\mathcal{V}$ is the set of functions and $\mathcal{E}$ contains edges such that an edge from $u$ to $v$ indicates that function $u$ calls function $v$. Both internal and external functions are represented. The analysis focuses on the subgraph induced by local functions, $\mathcal{V}_{loc}$, especially those calling sensitive APIs (Chen et al., 2 Sep 2025).

For each local function $f \in \mathcal{V}_{loc}$, HiGraph constructs a control flow graph

$G_f = (V_f, E_f),$

where each $\mathcal{V}$0 is a basic block, defined as a sequence of non-branching instructions, and each edge in $\mathcal{V}$1 represents possible control flow between blocks. Each application is thus encoded as a single outer FCG with multiple inner CFGs, one for each local function.

This “graph of graphs” design is the defining formal property of HiGraph. The outer graph captures inter-procedural structure; the inner graphs capture intra-procedural logic. The paper frames this explicit two-level organization as essential for robust and temporally consistent malware detection research. A plausible implication is that HiGraph is particularly suited to architectures that separate global aggregation from local message passing, rather than flattening all program structure into one adjacency relation.

3. Scale, labels, and curation policies

HiGraph contains 595,211 Android APKs spanning 2012–2022, with 595,211 FCGs and 201,792,085 CFGs, corresponding to an average of approximately 339 CFGs per app. The class distribution comprises 57,184 malicious apps and 538,027 benign apps. Malicious apps are labeled by detection in $\mathcal{V}$2 VirusTotal engines, while benign apps have 0 AV detections. Fine-grained malware family labels are assigned via AVClass2 (Chen et al., 2 Sep 2025).

Quantity	Value	Notes
Applications	595,211	Android APKs
FCGs	595,211	One per app
CFGs	201,792,085	Local-function CFGs
Malicious apps	57,184	$\mathcal{V}$3 VirusTotal detections
Benign apps	538,027	0 AV detections
Time span	2012–2022	Evenly sampled to December 2022

The dataset construction follows three stated policies for quality. Temporal consistency is enforced by evenly sampling apps from 2012 to December 2022, with the explicit aim of avoiding bias from concept drift and future-sample leakage. Spatial consistency keeps the benign-to-malicious ratio close to real-world prevalence, approximately 9:1. Comprehensive feature extraction provides CFG node features as 11-dimensional vectors summarizing instruction categories, content metrics, and structural information.

HiGraph also reports class-conditional graph-size statistics. At the FCG level, benign apps average 791.54 nodes and 1,414.51 edges, while malicious apps average 266.48 nodes and 491.67 edges. At the CFG level, benign graphs average 12.17 nodes and 13.94 edges, while malicious graphs average 12.29 nodes and 14.94 edges. These figures are important because they immediately complicate the simplistic assumption that malicious software is merely “larger”: in HiGraph, malware FCGs are on average smaller than benign ones, but later analysis shows them to be denser and more centralized.

4. Structural signatures of benign and malicious software

A large-scale empirical analysis on HiGraph identifies distinct structural signatures separating benign and malicious software at both hierarchical levels. At the FCG level, malicious apps have higher maximum PageRank and degree, indicating central “hubs.” Over time, benign software evolves toward lower density and greater modularity, whereas malware evolves toward denser, more centralized FCGs. The paper states that benign FCGs become larger and sparser as software grows, while malware FCGs, although becoming smaller after 2016, become denser and more centralized (Chen et al., 2 Sep 2025).

At the CFG level, malware exhibits higher degrees and higher cyclomatic complexity, corresponding to more convoluted local logic. Benign CFGs are described as growing in size and becoming sparser, whereas malware CFGs remain relatively small but retain higher density. The interpretation offered in the paper is that such dense local logic may hinder static analysis or manual review.

The dataset also supports cross-level correlation analysis. In malware, the correlation between a function’s PageRank centrality in the FCG and the cyclomatic complexity of its corresponding CFG is reported as $\mathcal{V}$4, a strong positive relationship. In benign software, the corresponding correlation is $\mathcal{V}$5, a weak negative relationship. This indicates that in malware, structurally central functions also tend to be locally complex, whereas benign software does not exhibit the same alignment between architectural centrality and local complexity.

API usage statistics reinforce this distinction. Malicious software shows higher occurrence of security-sensitive Android APIs, with TelephonyManager named as an example, while benign software is dominated by common utility APIs. Taken together, these observations suggest that HiGraph is not only a training corpus but also a descriptive resource for studying how malicious software concentrates functionality, obscures critical logic, and differs from benign evolution over time.

5. Benchmarking and research uses

HiGraph is intended for hierarchical graph learning and malware detection, with benchmark tasks including binary and multiclass malware classification, including family-level classification, and the analysis of temporal robustness under concept drift. The benchmark experiments reported in the paper show that hierarchical GNN models trained on HiGraph, denoted Hi-GNN, outperform single-level GNNs on both accuracy and temporal robustness (Chen et al., 2 Sep 2025).

Temporal robustness is evaluated with the Area Under Time (AUT) metric,

$\mathcal{V}$6

where $\mathcal{V}$7 is the Macro F1 score at time $\mathcal{V}$8 and $\mathcal{V}$9 is the number of evaluated time steps. The inclusion of AUT formalizes the paper’s emphasis on concept drift: malware detection quality is not treated as a static benchmark outcome but as a time-indexed quantity that must remain stable under software and threat evolution.

The dataset’s two-level structure makes it suitable for methods that explicitly model interactions between inter-procedural and intra-procedural structure. The paper’s central methodological claim is that hierarchical representations are vital for robust malware detection, especially under evolution and code obfuscation. This suggests a research agenda in which detectors are evaluated not only by immediate classification performance but by whether they preserve discriminative structural semantics across time.

6. Release, tooling, and conceptual scope

HiGraph is publicly available with dataset files, processing scripts, and model code at https://higraph.org. The release includes interactive visualization of FCG and CFG structures, statistical analysis dashboards, and sample exploration utilities. The full preprocessing and graph-construction pipeline is described as open-source and documented for reproducibility, and the dataset is released under CC BY-NC-SA 4.0 (Chen et al., 2 Sep 2025).

Conceptually, HiGraph belongs to the broader family of higher-order or non-flat graph representations, but it is specifically a hierarchical graph dataset rather than a hypergraph dataset. In the terminology of the Hybrid Graph Benchmark, hierarchical graphs are one subcase within a larger space of “hybrid graphs” that combine pairwise, higher-order, and hierarchical relations (Li et al., 2023). This suggests that HiGraph occupies a precise representational niche: it models nesting of graphs inside graph nodes, rather than arbitrary-size hyperedges.

The name should also be distinguished from unrelated uses of similar terminology in the literature. “HiGraph” has been used for a graph analytics accelerator based on a Multiple-stage Decentralized Propagation network (Lin et al., 2022), while “higraph” in Abstract Relational Calculus denotes a diagrammatic hierarchical graph modality for human understanding of query structure (Gatterbauer et al., 15 Dec 2025). Those usages are separate from the malware-analysis dataset. Within malware analysis, however, HiGraph denotes the Android corpus and graph-of-graphs representation introduced in 2025, whose primary significance lies in making large-scale hierarchical program structure available as a public benchmark.