An Android Malware Detection and Malicious Code Location Method Based on Graph Neural Network

Wu, Qing; Sun, Peng; Hong, Xueshu; Zhu, Xueling; Liu, Bo

doi:10.1145/3490725.3490733

Cited by 3 publications

(1 citation statement)

References 20 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…MKLDroid and Doidetec could achieve a reasonable recall of malicious segments (classes or methods) by sacrificing precision. Recently, Wu et al proposed a Graph Neural Network based approach [83] for Android malware detection and malicious code localization. Despite the help of manual checks, the obtained accuracy is still far from perfect.…”

Section: B Android Analysis Tasksmentioning

confidence: 99%

DexBERT: Effective, Task-Agnostic and Fine-Grained Representation Learning of Android Bytecode

Sun,

Allix,

Kim

et al. 2023

IIEEE Trans. Software Eng.

View full text Add to dashboard Cite

The automation of an increasingly large number of software engineering tasks is becoming possible thanks to Machine Learning (ML). One foundational building block in the application of ML to software artifacts is the representation of these artifacts (e.g., source code or executable code) into a form that is suitable for learning. Traditionally, researchers and practitioners have relied on manually selected features, based on expert knowledge, for the task at hand. Such knowledge is sometimes imprecise and generally incomplete. To overcome this limitation, many studies have leveraged representation learning, delegating to ML itself the job of automatically devising suitable representations and selections of the most relevant features. Yet, in the context of Android problems, existing models are either limited to coarse-grained whole-app level (e.g., apk2vec) or conducted for one specific downstream task (e.g., smali2vec). Thus, the produced representation may turn out to be unsuitable for fine-grained tasks or cannot generalize beyond the task that they have been trained on. Our work is part of a new line of research that investigates effective, task-agnostic, and fine-grained universal representations of bytecode to mitigate both of these two limitations. Such representations aim to capture information relevant to various low-level downstream tasks (e.g., at the class-level). We are inspired by the field of Natural Language Processing, where the problem of universal representation was addressed by building Universal Language Models, such as BERT, whose goal is to capture abstract semantic information about sentences, in a way that is reusable for a variety of tasks. We propose DexBERT, a BERT-like Language Model dedicated to representing chunks of DEX bytecode, the main binary format used in Android applications. We empirically assess whether DexBERT is able to model the DEX language and evaluate the suitability of our model in three distinct classlevel software engineering tasks: Malicious Code Localization, Defect Prediction, and Component Type Classification. We also experiment with strategies to deal with the problem of catering to apps having vastly different sizes, and we demonstrate one example of using our technique to investigate what information is relevant to a given task.

show abstract

Section: B Android Analysis Tasksmentioning

confidence: 99%