Abstract:The smartphone has become an indispensable tool in our daily lives, and the Android operating system is widely installed on our smartphones. This makes Android smartphones a prime target for malware. In order to address threats posed by malware, many researchers have proposed different malware detection approaches, including using a function call graph (FCG). Although an FCG can capture the complete call-callee semantic relationship of a function, it will be represented as a huge graph structure. The presence of many nonsensical nodes affects the detection efficiency. At the same time, the characteristics of the graph neural networks (GNNs) make the important node features in the FCG tend toward similar nonsensical node features during the propagation process. In our work, we propose an Android malware detection approach to enhance node feature differences in an FCG. Firstly, we propose an API-based node feature by which we can visually analyze the behavioral properties of different functions in the app and determine whether their behavior is benign or malicious. Then, we extract the FCG and the features of each function from the decompiled APK file. Next, we calculate the API coefficient inspired by the idea of the TF-IDF algorithm and extract the sensitive function called subgraph (S-FCSG) based on API coefficient ranking. Finally, before feeding the S-FCSG and node features into the GCN model, we add the self-loop for each node of the S-FCSG. A 1-D convolutional neural network and fully connected layers are used for further feature extraction and classification, respectively. The experimental result shows that our approach enhances the node feature differences in an FCG, and the detection accuracy is greater than that of models using other features, suggesting that malware detection based on a graph structure and GNNs has a lot of space for future study.

Call Graph Based Android Malware Detection with CNN

Android malware detection method based on function call graphs

Automaticlly Learning Featurs of Android Apps Using CNN

Learning features from enhanced function call graphs for Android malware detection

An Android Malware Detection Approach to Enhance Node Feature Differences in a Function Call Graph Based on GCNs

An Android Malware Detection Method Using Deep Learning Based on API Calls

Detecting Android Malware Using Bytecode Image

Toward Mobile Malware Detection Through Convolutional Neural Networks

A Novel Approach for Mobile Malware Classification and Detection in Android Systems.

Android malware detection method based on bytecode image

Mining Behavior Pattern of Mobile Malware with Convolutional Neural Network

Enhancing android malware detection explainability through function call graph APIs

OpCode-Level Function Call Graph Based Android Malware Classification Using Deep Learning

ConvDroid: Lightweight Neural Network Based Andoird Malware Detection.

An Android Malware Detection Method Using Multi-Feature and MobileNet.

A novel method of detecting malware on Android mobile devices with explainable artificial intelligence

Android Malware Detection using Large-scale Network Representation Learning

Analysis, Detection, and Classification of Android Malware using System Calls

Learning-Based Detection for Malicious Android Application Using Code Vectorization

Android Malware Detection Method Based on Graph Attention Networks and Deep Fusion of Multimodal Features.

Android Malware Detection Based on System Call Sequences and LSTM