Abstract:The proliferation of malware in recent years has posed a significant threat to the security of computers and mobile devices . Detecting malware, especially on the Android platform, has become a growing concern for researchers and the software industry. This paper proposes a new method for detecting Android malware based on unbalanced heterogeneous graph embedding. First of all, most malware datasets contain an imbalance of malicious and benign samples, since some types of malware are scarce and difficult to collect. Thus, as a result of this problem, the classification algorithm is unable to analyze the minority samples through sufficient data, resulting in poor downstream classifier performance, in light of the fact that adversarial generation networks possess the characteristic of completing data, an algorithm for generating graph structure data is presented, in which nodes are generated to simulate the distribution of minority nodes within a network topology . Then, considering that heterogeneous information networks have the characteristics of retaining rich node semantic features and mining implicit relationships, heterogeneous graphs are used to construct models for different types of entities (i.e. Apps, APIs, permissions, intents, etc.) and different meta-paths. Finally, a new method is introduced to alleviate the over-smoothing phenomenon of node information in the propagation of deep network. In the deep GCN, we first sample the leader nodes of each layer node, and then add a residual connection and an identity map in order to determine the characteristics of the high-order leader. In this paper, a self-attention-based semantic fusion method is also applied to adaptively fuse embedded representations of software nodes under different meta-paths. The test results demonstrate that the proposed IHODroid model effectively detects malicious software. In the DREBIN dataset, which consists of 123,453 Android applications and 5,560 malicious samples, the IHODroid model achieves an accuracy of 0.9360 and an F1 score of 0.9360, outperforming other state-of-the-art baseline methods.

Exploit Internal Structural Information for IoT Malware Detection Based on Hierarchical Transformer Model

TransMalDE: an Effective Transformer Based Hierarchical Framework for IoT Malware Detection

An Evolutionary Study of IoT Malware

Transformer-Based Malicious Traffic Detection for Internet of Things

Efficient Detection and Classification of Internet-of-Things Malware Based on Byte Sequences from Executable Files

IoT Malware Classification Based on Reinterpreted Function-Call Graphs

AdaTrans: An adaptive transformer for IoT Malware detection based on sensitive API call graph and inter-component communication analysis

Deep Neural Networks for Enhanced Security: Detecting Metamorphic Malware in IoT Devices

Performance Evaluation of Deep Learning Techniques in The Detection of IOT Malware

CMD: Co-analyzed IoT Malware Detection and Forensics Via Network and Hardware Domains

Machine learning-based malware detection for IoT devices using control-flow data

Multi-Level Intrusion Detection Based on Transformer and Wavelet Transform for IoT Data Security

MTHAEL: Cross-Architecture IoT Malware Detection Based on Neural Network Advanced Ensemble Learning.

Automatic Analysis Architecture of IoT Malware Samples

Improving Robustness in IoT Malware Detection through Execution Order Analysis

CNN-Based Malware Variants Detection Method for Internet of Things

Lightweight Classification of IoT Malware based on Image Recognition

Malware Detection for Internet of Things Using One-Class Classification

A Lean Transformer Model for Dynamic Malware Analysis and Detection

Harnessing the Power of Decision Trees to Detect IoT Malware

A malware detection model based on imbalanced heterogeneous graph embeddings