Abstract:The proliferation of malware in recent years has posed a significant threat to the security of computers and mobile devices . Detecting malware, especially on the Android platform, has become a growing concern for researchers and the software industry. This paper proposes a new method for detecting Android malware based on unbalanced heterogeneous graph embedding. First of all, most malware datasets contain an imbalance of malicious and benign samples, since some types of malware are scarce and difficult to collect. Thus, as a result of this problem, the classification algorithm is unable to analyze the minority samples through sufficient data, resulting in poor downstream classifier performance, in light of the fact that adversarial generation networks possess the characteristic of completing data, an algorithm for generating graph structure data is presented, in which nodes are generated to simulate the distribution of minority nodes within a network topology . Then, considering that heterogeneous information networks have the characteristics of retaining rich node semantic features and mining implicit relationships, heterogeneous graphs are used to construct models for different types of entities (i.e. Apps, APIs, permissions, intents, etc.) and different meta-paths. Finally, a new method is introduced to alleviate the over-smoothing phenomenon of node information in the propagation of deep network. In the deep GCN, we first sample the leader nodes of each layer node, and then add a residual connection and an identity map in order to determine the characteristics of the high-order leader. In this paper, a self-attention-based semantic fusion method is also applied to adaptively fuse embedded representations of software nodes under different meta-paths. The test results demonstrate that the proposed IHODroid model effectively detects malicious software. In the DREBIN dataset, which consists of 123,453 Android applications and 5,560 malicious samples, the IHODroid model achieves an accuracy of 0.9360 and an F1 score of 0.9360, outperforming other state-of-the-art baseline methods.

SNDGCN: Robust Android malware detection based on subgraph network and denoising GCN network

An Android Malware Detection Approach to Enhance Node Feature Differences in a Function Call Graph Based on GCNs

GDroid: Android Malware Detection and Classification with Graph Convolutional Network

Android Malware Detection Based on a Hybrid Deep Learning Model

GSEDroid: GNN-based Android malware detection framework using lightweight semantic embedding

MASKDROID: Robust Android Malware Detection with Masked Graph Representations

Android Malware Detection using Large-scale Network Representation Learning

ConvDroid: Lightweight Neural Network Based Andoird Malware Detection.

Automatic Detection of Android Malware via Hybrid Graph Neural Network

GHGDroid: Global heterogeneous graph-based android malware detection

A malware detection model based on imbalanced heterogeneous graph embeddings

Mal2GCN: A Robust Malware Detection Approach Using Deep Graph Convolutional Networks With Non-Negative Weights

Flexible Android Malware Detection Model based on Generative Adversarial Networks with Code Tensor

Function-level Obfuscation Detection Method Based on Graph Convolutional Networks

NT-GNN: Network Traffic Graph for 5G Mobile IoT Android Malware Detection

OpCode-Level Function Call Graph Based Android Malware Classification Using Deep Learning

Deep Android Malware Detection

Android Malware Detection Technology Based on Lightweight Convolutional Neural Networks

AndroCreme - Unseen Android Malware Detection Based on Inductive Conformal Learning.

NMal-Droid: network-based android malware detection system using transfer learning and CNN-BiGRU ensemble

DeepDetector: Android Malware Detection using Deep Neural Network