---
title: 'HiGraph: Hierarchical Malware Analysis'
url: https://www.emergentmind.com/topics/higraph
type: topic
---

# HiGraph: Hierarchical Malware Analysis

HiGraph is a large-scale hierarchical graph dataset for Android malware analysis that models each application as a two-level “graph of graphs”: a global Function Call Graph (FCG) whose local-function nodes contain Control Flow Graphs (CFGs). It was introduced to address a central limitation of prior graph-based malware corpora, namely the reduction of programs to single-level graphs that do not preserve the interaction between high-level functional structure and low-level instruction logic. HiGraph comprises over **200M** CFGs nested within **595K** FCGs, and is presented as the largest public hierarchical graph dataset for malware analysis, with public data and tooling released at **https://higraph.org** [2509.02113].

## 1. Motivation and problem setting

HiGraph was developed against the background that graph-based malware analysis, particularly with GNNs, has been constrained by the absence of datasets that capture the inherent hierarchical structure of software. Existing datasets are described as “flat” single-level graphs, which miss the interplay between intra-procedural behavior and inter-procedural organization. In the HiGraph formulation, this omission is consequential because malware detection must contend with malware evolution and code obfuscation, both of which can alter surface-level structure while preserving deeper semantic organization [2509.02113].

The dataset therefore treats hierarchy not as an auxiliary annotation but as the primary representational principle. The intended gain is semantic preservation across two complementary scales: architecture-level behavior through function interactions, and logic-level behavior through basic-block control flow. A common misconception in this area is that richer malware representation mainly requires larger graphs. HiGraph instead emphasizes that the issue is representational granularity: a single large graph can still collapse distinctions between global calling structure and local execution logic.

## 2. Hierarchical data model

For each Android application, HiGraph extracts a function call graph
$$
\mathcal{G} = (\mathcal{V}, \mathcal{E}),
$$
where $\mathcal{V}$ is the set of functions and $\mathcal{E}$ contains edges such that an edge from $u$ to $v$ indicates that function $u$ calls function $v$. Both internal and external functions are represented. The analysis focuses on the subgraph induced by local functions, $\mathcal{V}_{loc}$, especially those calling sensitive APIs [2509.02113].

For each local function $f \in \mathcal{V}_{loc}$, HiGraph constructs a control flow graph
$$
G_f = (V_f, E_f),
$$
where each $u \in V_f$ is a basic block, defined as a sequence of non-branching instructions, and each edge in $E_f$ represents possible control flow between blocks. Each application is thus encoded as a single outer FCG with multiple inner CFGs, one for each local function.

This “graph of graphs” design is the defining formal property of HiGraph. The outer graph captures inter-procedural structure; the inner graphs capture intra-procedural logic. The paper frames this explicit two-level organization as essential for robust and temporally consistent malware detection research. A plausible implication is that HiGraph is particularly suited to architectures that separate global aggregation from local message passing, rather than flattening all program structure into one adjacency relation.

## 3. Scale, labels, and curation policies

HiGraph contains **595,211 Android APKs** spanning **2012–2022**, with **595,211 FCGs** and **201,792,085 CFGs**, corresponding to an average of approximately **339** CFGs per app. The class distribution comprises **57,184 malicious apps** and **538,027 benign apps**. Malicious apps are labeled by detection in **$\geq 15$ VirusTotal engines**, while benign apps have **0 AV detections**. Fine-grained malware family labels are assigned via **AVClass2** [2509.02113].

| Quantity | Value | Notes |
|---|---:|---|
| Applications | 595,211 | Android APKs |
| FCGs | 595,211 | One per app |
| CFGs | 201,792,085 | Local-function CFGs |
| Malicious apps | 57,184 | $\geq 15$ VirusTotal detections |
| Benign apps | 538,027 | 0 AV detections |
| Time span | 2012–2022 | Evenly sampled to December 2022 |

The dataset construction follows three stated policies for quality. **Temporal consistency** is enforced by evenly sampling apps from 2012 to December 2022, with the explicit aim of avoiding bias from concept drift and future-sample leakage. **Spatial consistency** keeps the benign-to-malicious ratio close to real-world prevalence, approximately **9:1**. **Comprehensive feature extraction** provides CFG node features as **11-dimensional vectors** summarizing instruction categories, content metrics, and structural information.

HiGraph also reports class-conditional graph-size statistics. At the FCG level, benign apps average **791.54** nodes and **1,414.51** edges, while malicious apps average **266.48** nodes and **491.67** edges. At the CFG level, benign graphs average **12.17** nodes and **13.94** edges, while malicious graphs average **12.29** nodes and **14.94** edges. These figures are important because they immediately complicate the simplistic assumption that malicious software is merely “larger”: in HiGraph, malware FCGs are on average smaller than benign ones, but later analysis shows them to be denser and more centralized.

## 4. Structural signatures of benign and malicious software

A large-scale empirical analysis on HiGraph identifies distinct structural signatures separating benign and malicious software at both hierarchical levels. At the FCG level, malicious apps have higher maximum PageRank and degree, indicating central “hubs.” Over time, benign software evolves toward lower density and greater modularity, whereas malware evolves toward denser, more centralized FCGs. The paper states that benign FCGs become larger and sparser as software grows, while malware FCGs, although becoming smaller after 2016, become denser and more centralized [2509.02113].

At the CFG level, malware exhibits higher degrees and higher cyclomatic complexity, corresponding to more convoluted local logic. Benign CFGs are described as growing in size and becoming sparser, whereas malware CFGs remain relatively small but retain higher density. The interpretation offered in the paper is that such dense local logic may hinder static analysis or manual review.

The dataset also supports cross-level correlation analysis. In malware, the correlation between a function’s PageRank centrality in the FCG and the cyclomatic complexity of its corresponding CFG is reported as **$R = 0.48$**, a strong positive relationship. In benign software, the corresponding correlation is **$R = -0.18$**, a weak negative relationship. This indicates that in malware, structurally central functions also tend to be locally complex, whereas benign software does not exhibit the same alignment between architectural centrality and local complexity.

API usage statistics reinforce this distinction. Malicious software shows higher occurrence of security-sensitive Android APIs, with **TelephonyManager** named as an example, while benign software is dominated by common utility APIs. Taken together, these observations suggest that HiGraph is not only a training corpus but also a descriptive resource for studying how malicious software concentrates functionality, obscures critical logic, and differs from benign evolution over time.

## 5. Benchmarking and research uses

HiGraph is intended for hierarchical graph learning and malware detection, with benchmark tasks including binary and multiclass malware classification, including family-level classification, and the analysis of temporal robustness under concept drift. The benchmark experiments reported in the paper show that hierarchical GNN models trained on HiGraph, denoted **Hi-GNN**, outperform single-level GNNs on both accuracy and temporal robustness [2509.02113].

Temporal robustness is evaluated with the **Area Under Time (AUT)** metric,
$$
AUT(f,N) = \frac{1}{N-1} \sum_{k=0}^{N-1} \frac{[f(k+1) + f(k)]}{2},
$$
where $f(k)$ is the Macro F1 score at time $k$ and $N$ is the number of evaluated time steps. The inclusion of AUT formalizes the paper’s emphasis on concept drift: malware detection quality is not treated as a static benchmark outcome but as a time-indexed quantity that must remain stable under software and threat evolution.

The dataset’s two-level structure makes it suitable for methods that explicitly model interactions between inter-procedural and intra-procedural structure. The paper’s central methodological claim is that hierarchical representations are vital for robust malware detection, especially under evolution and code obfuscation. This suggests a research agenda in which detectors are evaluated not only by immediate classification performance but by whether they preserve discriminative structural semantics across time.

## 6. Release, tooling, and conceptual scope

HiGraph is publicly available with dataset files, processing scripts, and model code at **https://higraph.org**. The release includes interactive visualization of FCG and CFG structures, statistical analysis dashboards, and sample exploration utilities. The full preprocessing and graph-construction pipeline is described as open-source and documented for reproducibility, and the dataset is released under **CC BY-NC-SA 4.0** [2509.02113].

Conceptually, HiGraph belongs to the broader family of higher-order or non-flat graph representations, but it is specifically a **hierarchical graph** dataset rather than a hypergraph dataset. In the terminology of the Hybrid Graph Benchmark, hierarchical graphs are one subcase within a larger space of “hybrid graphs” that combine pairwise, higher-order, and hierarchical relations [2306.05108]. This suggests that HiGraph occupies a precise representational niche: it models nesting of graphs inside graph nodes, rather than arbitrary-size hyperedges.

The name should also be distinguished from unrelated uses of similar terminology in the literature. **“HiGraph”** has been used for a graph analytics accelerator based on a Multiple-stage Decentralized Propagation network [2202.11343], while **“higraph”** in Abstract Relational Calculus denotes a diagrammatic hierarchical graph modality for human understanding of query structure [2512.12957]. Those usages are separate from the malware-analysis dataset. Within malware analysis, however, HiGraph denotes the Android corpus and graph-of-graphs representation introduced in 2025, whose primary significance lies in making large-scale hierarchical program structure available as a public benchmark.

Source: https://www.emergentmind.com/topics/higraph