Abstract:The proliferation of malware in recent years has posed a significant threat to the security of computers and mobile devices . Detecting malware, especially on the Android platform, has become a growing concern for researchers and the software industry. This paper proposes a new method for detecting Android malware based on unbalanced heterogeneous graph embedding. First of all, most malware datasets contain an imbalance of malicious and benign samples, since some types of malware are scarce and difficult to collect. Thus, as a result of this problem, the classification algorithm is unable to analyze the minority samples through sufficient data, resulting in poor downstream classifier performance, in light of the fact that adversarial generation networks possess the characteristic of completing data, an algorithm for generating graph structure data is presented, in which nodes are generated to simulate the distribution of minority nodes within a network topology . Then, considering that heterogeneous information networks have the characteristics of retaining rich node semantic features and mining implicit relationships, heterogeneous graphs are used to construct models for different types of entities (i.e. Apps, APIs, permissions, intents, etc.) and different meta-paths. Finally, a new method is introduced to alleviate the over-smoothing phenomenon of node information in the propagation of deep network. In the deep GCN, we first sample the leader nodes of each layer node, and then add a residual connection and an identity map in order to determine the characteristics of the high-order leader. In this paper, a self-attention-based semantic fusion method is also applied to adaptively fuse embedded representations of software nodes under different meta-paths. The test results demonstrate that the proposed IHODroid model effectively detects malicious software. In the DREBIN dataset, which consists of 123,453 Android applications and 5,560 malicious samples, the IHODroid model achieves an accuracy of 0.9360 and an F1 score of 0.9360, outperforming other state-of-the-art baseline methods.

Detecting Malicious Server Based on Server-to-Server Realation Graph.

File Relation Graph Based Malware Detection Using Label Propagation

K-Means Clustering Analysis Based On Adaptive Weights For Malicious Code Detection

Detecting Malicious Domains with Behavioral Modeling and Graph Embedding

Coordinated Web Scan Detection Based on Hierarchical Correlation

A Multivariate Classification Algorithm for Malicious Node Detection in Large-Scale WSNs

A Novel Approach for Real-Time Server-Based Attack Detection Using Meta-Learning

A Deep Belief Network Based Machine Learning System for Risky Host Detection

Graph based Encrypted Malicious Traffic Detection with Hybrid Analysis of Multi-view Features

Botnet Detection using Social Graph Analysis

Log2vec: A Heterogeneous Graph Embedding Based Approach for Detecting Cyber Threats within Enterprise

From Big Data to Knowledge: A Spatio-Temporal Approach to Malware Detection

GraphMal: A Network Malicious Traffic Identification Method Based on Graph Neural Network

Encrypted Malware Traffic Detection Via Graph-based Network Analysis.

Learning to Detect Malicious Clients for Robust Federated Learning

Malicious DNS detection by combining improved transformer and CNN

Automatic Botnet Attack Identification Based on Machine Learning

Detecting Malignant TLS Servers Using Machine Learning Techniques

An unknown malware detection scheme based on the features of graph

Malicious Internet Entity Detection Using Local Graph Inference

A malware detection model based on imbalanced heterogeneous graph embeddings