Abstract:With the widespread use of smartphones, Android malware has posed serious threats to its security. Given the explosive growth of Android malware variants, detecting malware families are crucial for identifying new security threats, triaging, and building reference datasets. Building behavior profiles of Android applications (apps) with holistic graph-based features would help to retain program semantics and resist obfuscation. It is more effective to use representation with the low-dimensional feature, which could reduce calculation cost and improve the efficiency of downstream analytics tasks. To achieve this goal, we design and develop a practical system for the familial analysis of Android malware named GSFDroid. We first use graph-based features that contain structural information to analyze app behavior. Then, we employ Graph Convolutional Networks (GCNs) to embed nodes into a continuous and low-dimensional space, which improves the efficiency of downstream analytics tasks. Note that distributions of the learned feature vectors of APKs are not aligned and centered caused by the random initialization and propagation strategy of GCN, whose different scales can harm the performance of downstream tasks. Inspired by the z-s c o r e, we propose a simple graph feature normalization to standardize the embedded APK features. Finally, instead of fully supervised or unsupervised learning, we propose a two-phased familial analysis method fusing a semi-supervised classifier with a cluster operation on high uncertain score samples respect to the classifier. Promising experimental results based on real-world datasets demonstrate that our approach significantly outperforms state-of-the-art approaches, and can effectively cluster new malware samples from unknown families.

Semi-Supervised Malware Clustering Based on the Weight of Bytecode and API.

Malware Clustering Based on SNN Density Using System Calls.

K-Means Clustering Analysis Based On Adaptive Weights For Malicious Code Detection

A malware variant clustering method based on fuzzy hash

Android Malware Family Clustering Based on Multiple Features

Online Clustering of Known and Emerging Malware Families

Android Malware Clustering through Malicious Payload Mining

Malware Analysis Using Machine Learning and Deep Learning Techniques

Online Analytical Model of Massive Malware Based on Feature Clusting

Malware Detection with Directed Cyclic Graph and Weight Merging

Research on Features Selection in Malware Clustering

A New Malware Classification Approach Based On Malware Dynamic Analysis

Automatic Malware Classification and New Malware Detection Using Machine Learning

Malware Classification based on Call Graph Clustering

An Android Malware Detection Approach Using Community Structures of Weighted Function Call Graphs.

A Parameter-Free Hybrid Clustering Algorithm Used for Malware Categorization

Using a Fine-Grained Hybrid Feature for Malware Similarity Analysis.

Identifying Parasitic Malware As Outliers by Code Clustering

Semi-supervised Two-Phase Familial Analysis of Android Malware with Normalized Graph Embedding

Clustering based opcode graph generation for malware variant detection

An Efficient Android Malware Detection System Based on Method-Level Behavioral Semantic Analysis.