Abstract:The proliferation of malware in recent years has posed a significant threat to the security of computers and mobile devices . Detecting malware, especially on the Android platform, has become a growing concern for researchers and the software industry. This paper proposes a new method for detecting Android malware based on unbalanced heterogeneous graph embedding. First of all, most malware datasets contain an imbalance of malicious and benign samples, since some types of malware are scarce and difficult to collect. Thus, as a result of this problem, the classification algorithm is unable to analyze the minority samples through sufficient data, resulting in poor downstream classifier performance, in light of the fact that adversarial generation networks possess the characteristic of completing data, an algorithm for generating graph structure data is presented, in which nodes are generated to simulate the distribution of minority nodes within a network topology . Then, considering that heterogeneous information networks have the characteristics of retaining rich node semantic features and mining implicit relationships, heterogeneous graphs are used to construct models for different types of entities (i.e. Apps, APIs, permissions, intents, etc.) and different meta-paths. Finally, a new method is introduced to alleviate the over-smoothing phenomenon of node information in the propagation of deep network. In the deep GCN, we first sample the leader nodes of each layer node, and then add a residual connection and an identity map in order to determine the characteristics of the high-order leader. In this paper, a self-attention-based semantic fusion method is also applied to adaptively fuse embedded representations of software nodes under different meta-paths. The test results demonstrate that the proposed IHODroid model effectively detects malicious software. In the DREBIN dataset, which consists of 123,453 Android applications and 5,560 malicious samples, the IHODroid model achieves an accuracy of 0.9360 and an F1 score of 0.9360, outperforming other state-of-the-art baseline methods.

Probabilistic Inference on Integrity for Access Behavior Based Malware Detection.

Centrality Metrics of Importance in Access Behaviors and Malware Detections.

A malware detection framework based on kolmogorov complexity

Security Importance Assessment for System Objects and Malware Detection

Advanced Cybersecurity Enhancement through Mathematical Models: A Comprehensive Approach Using Statistical Methods, Cryptographic Techniques, and Machine Learning Algorithms (SVM, Random Forest, and Neural Networks) for Behavior-Based Malware Detection

On the Robustness of Machine Learning Based Malware Detection Algorithms

AI@nti-Malware: An intelligent framework for defending against malware attacks

You Are What You Do: Hunting Stealthy Malware Via Data Provenance Analysis

A Static Method for Detection of Information Theft Malware

Discovering Malicious Signatures in Software from Structural Interactions

Quo Vadis: Hybrid Machine Learning Meta-Model based on Contextual and Behavioral Malware Representations

Leveraging Uncertainty for Improved Static Malware Detection Under Extreme False Positive Constraints

A multi-objective sequential three-way decision approach for real-time malware detection

A malware detection model based on imbalanced heterogeneous graph embeddings

Malware Detection Module using Machine Learning Algorithms to Assist in Centralized Security in Enterprise Networks

Efficient and Robust Malware Detection Based on Control Flow Traces Using Deep Neural Networks

DRSM: De-Randomized Smoothing on Malware Classifier Providing Certified Robustness

Malware Detected and Tell MeWhy: An Verifiable Malware Detection Model with Graph Metric Learning

A Probabilistic Analysis Framework for Malicious Insider Threats.

Malware Analysis and Detection Using Machine Learning Algorithms