Abstract
Malware detection based on graph neural networks (GNNs) has shown promising results by modeling malicious software as graphs. However, real-world malware datasets exhibit two types of imbalance: class imbalance where certain families are underrepresented, and graph size imbalance where graphs vary dramatically in complexity. These imbalances lead to biased models that perform poorly on minority families and small/large graphs. We propose MalGoG, a novel Graph-ofGraphs framework that addresses both imbalances in malware graph classification. Our approach consists of two stages: (1) a GNN encoder extracts embeddings from individual malware graphs, and (2) these embeddings become nodes in a higher-level graph where edges connect similar samples, enabling imbalanceaware GNN backbones to leverage inter-sample relationships. We employ a joint training strategy with gradient normalization to optimize both components simultaneously. Experiments on two malware datasets demonstrate that MalGoG significantly improves classification accuracy, outperforming standard GNN baselines.