Malware detection has become a major concern due to the increasing number and complexity of malware. Traditional detection methods based on signatures and heuristics are used for malware detection, but unfortunately, they suffer from poor generalization to unknown attacks and can be easily circumvented using obfuscation techniques. In recent years, Machine Learning (ML) and notably Deep Learning (DL) achieved impressive results in malware detection by learning useful representations from data and have become a solution preferred over traditional methods. Recently, the application of Graph Representation Learning (GRL) techniques on graph-structured data has demonstrated impressive capabilities in malware detection. This success benefits notably from the robust structure of graphs, which are challenging for attackers to alter, and their intrinsic explainability capabilities. In this survey, we provide an in-depth literature review to summarize and unify existing works under the common approaches and architectures. We notably demonstrate that Graph Neural Networks (GNNs) reach competitive results in learning robust embeddings from malware represented as expressive graph structures such as Function Call Graphs (FCGs) and Control Flow Graphs (CFGs). This study also discusses the robustness of GRL-based methods to adversarial attacks, contrasts their effectiveness with other ML/DL approaches, and outlines future research for practical deployment.

由于恶意软件的数量和复杂性不断增加，恶意软件检测已成为一个主要问题。基于签名和启发式的传统检测方法用于恶意软件检测，但不幸的是，它们对未知攻击的泛化性较差，并且可以使用混淆技术轻松规避。近年来，机器学习（ML），尤其是深度学习（DL）通过从数据中学习有用的表示，在恶意软件检测方面取得了令人印象深刻的成果，并且已成为优于传统方法的解决方案。最近，图表示学习（GRL）技术在图结构数据上的应用在恶意软件检测中展现了令人印象深刻的能力。这一成功主要得益于图的稳健结构（攻击者很难改变图的结构）及其内在的可解释性能力。在本次调查中，我们提供了深入的文献综述，以总结和统一通用方法和架构下的现有工作。我们特别证明，图神经网络（GNN）在从表示为表达性图结构（例如函数调用图（FCG）和控制流图（CFG））的恶意软件中学习鲁棒嵌入方面取得了有竞争力的结果。这项研究还讨论了基于 GRL 的方法对对抗性攻击的鲁棒性，将其与其他 ML/DL 方法的有效性进行了对比，并概述了实际部署的未来研究。