Abstract:The proliferation of malware in recent years has posed a significant threat to the security of computers and mobile devices . Detecting malware, especially on the Android platform, has become a growing concern for researchers and the software industry. This paper proposes a new method for detecting Android malware based on unbalanced heterogeneous graph embedding. First of all, most malware datasets contain an imbalance of malicious and benign samples, since some types of malware are scarce and difficult to collect. Thus, as a result of this problem, the classification algorithm is unable to analyze the minority samples through sufficient data, resulting in poor downstream classifier performance, in light of the fact that adversarial generation networks possess the characteristic of completing data, an algorithm for generating graph structure data is presented, in which nodes are generated to simulate the distribution of minority nodes within a network topology . Then, considering that heterogeneous information networks have the characteristics of retaining rich node semantic features and mining implicit relationships, heterogeneous graphs are used to construct models for different types of entities (i.e. Apps, APIs, permissions, intents, etc.) and different meta-paths. Finally, a new method is introduced to alleviate the over-smoothing phenomenon of node information in the propagation of deep network. In the deep GCN, we first sample the leader nodes of each layer node, and then add a residual connection and an identity map in order to determine the characteristics of the high-order leader. In this paper, a self-attention-based semantic fusion method is also applied to adaptively fuse embedded representations of software nodes under different meta-paths. The test results demonstrate that the proposed IHODroid model effectively detects malicious software. In the DREBIN dataset, which consists of 123,453 Android applications and 5,560 malicious samples, the IHODroid model achieves an accuracy of 0.9360 and an F1 score of 0.9360, outperforming other state-of-the-art baseline methods.

File Relation Graph Based Malware Detection Using Label Propagation

Malware Analysis Using Machine Learning and Deep Learning Techniques

MalGraph: Hierarchical Graph Neural Networks for Robust Windows Malware Detection

A Novel Malware Detection System Based On Machine Learning and Binary Visualization

Malware Detection by Control-Flow Graph Level Representation Learning With Graph Isomorphism Network

Metamorphic Malware Detection Using Linear Discriminant Analysis and Graph Similarity

An unknown malware detection scheme based on the features of graph

Android Malware Detection using Large-scale Network Representation Learning

A malware detection model based on imbalanced heterogeneous graph embeddings

Graph embedding as a new approach for unknown malware detection

Detection of Malicious Software by Analyzing Distinct Artifacts Using Machine Learning and Deep Learning Algorithms

Malware Lineage in the Wild

Malicious Code Detection Using Machine Learning

A Layered Classification for Malicious Function Identification and Malware Detection

Automatic Malware Description via Attribute Tagging and Similarity Embedding

An Efficient DenseNet-Based Deep Learning Model for Malware Detection

A Novel Approach to Malicious Code Detection Using CNN-BiLSTM and Feature Fusion

A Comprehensive Review of Machine Learning Approaches for Detecting Malicious Software

Malware Detected and Tell MeWhy: An Verifiable Malware Detection Model with Graph Metric Learning

A Study on the Application of Distributed System Technology-Guided Machine Learning in Malware Detection

A Malware Detection Approach based on Deep Learning and Memory Forensics