Android Malware Detection Based on Call Graph via Graph Neural Network

Feng, Pengbin; Ma, Jianfeng; Li, Teng; Ma, Xindi; Xi, Ning; Lu, Di

doi:10.1109/nana51271.2020.00069

Cited by 13 publications

(6 citation statements)

References 11 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Figure 1: The relationship between the K l and the model F1Figure2shows that as the proportion of node confusion increases, our method performs better, and the decline is more stable than Peng's and Li's methods[5][6]. It shows our denoising graph neural network can remove the influence of confusion attack and achieve better detection performance.…”

mentioning

confidence: 82%

Robust android malware detection based on subgraph network and denoising GCN network

Zhao

Lió

2022

Proceedings of the 20th Annual International Conference on Mobile Systems, Applications and Services

View full text Add to dashboard Cite

This paper proposes an Android malware detection model based on Android Function Call Graph (FCG) and Denoising Graph Convolutional Neural Network. This study proposes a method to simplify the FCG to reduce its size, and a new method to construct vertex feature vectors. The model uses the subgraph network to detect the underlying structural features of the FCG and discover the confusion attack. A denoising graph neural network is applied to graph convolution to reduce the impact of obfuscation attacks. CCS CONCEPTS• Security and privacy~Software and application security~Software security engineering.

show abstract

mentioning

confidence: 82%

Robust android malware detection based on subgraph network and denoising GCN network

Zhao

Lió

2022

Proceedings of the 20th Annual International Conference on Mobile Systems, Applications and Services

View full text Add to dashboard Cite

show abstract

“…In CGdroid [36], multiple node features are extracted from the disassembled methods in order to build a FCG that captures the semantic of functions. Indeed, each node is mapped to a vector of hand-designed features such as the number of string constants, the number of call and jump instructions, the associated permissions, etc.…”

Section: Fcg Approachesmentioning

confidence: 99%

A Survey on Malware Detection with Graph Representation Learning

Bilot¹,

Madhoun²,

Agha³

et al. 2023

Preprint

View full text Add to dashboard Cite

Malware detection has become a major concern due to the increasing number and complexity of malware. Traditional detection methods based on signatures and heuristics are used for malware detection, but unfortunately, they suffer from poor generalization to unknown attacks and can be easily circumvented using obfuscation techniques. In recent years, Machine Learning (ML) and notably Deep Learning (DL) achieved impressive results in malware detection by learning useful representations from data and have become a solution preferred over traditional methods. More recently, the application of such techniques on graph-structured data has achieved state-of-the-art performance in various domains and demonstrates promising results in learning more robust representations from malware. Yet, no literature review focusing on graph-based deep learning for malware detection exists. In this survey, we provide an in-depth literature review to summarize and unify existing works under the common approaches and architectures. We notably demonstrate that Graph Neural Networks (GNNs) reach competitive results in learning robust embeddings from malware represented as expressive graph structures, leading to an efficient detection by downstream classifiers. This paper also reviews adversarial attacks that are utilized to fool graph-based detection methods. Challenges and future research directions are discussed at the end of the paper. CCS Concepts: • General and reference → Surveys and overviews; • Security and privacy → Malware and its mitigation; • Computing methodologies → Learning latent representations; Neural networks; Spectral methods.

show abstract

“…It needs to convert the graph structure data into vectors, while the graph neural network can directly learn the features. Feng et al [ 17 ] constructed the approximate call graph from function invocation relationships to represent the app. They extracted each intra-function attributes as node features in the graph.…”

Section: Related Workmentioning

confidence: 99%

An Android Malware Detection Approach to Enhance Node Feature Differences in a Function Call Graph Based on GCNs

Luktarhan

Tian

et al. 2023

Sensors

View full text Add to dashboard Cite

The smartphone has become an indispensable tool in our daily lives, and the Android operating system is widely installed on our smartphones. This makes Android smartphones a prime target for malware. In order to address threats posed by malware, many researchers have proposed different malware detection approaches, including using a function call graph (FCG). Although an FCG can capture the complete call–callee semantic relationship of a function, it will be represented as a huge graph structure. The presence of many nonsensical nodes affects the detection efficiency. At the same time, the characteristics of the graph neural networks (GNNs) make the important node features in the FCG tend toward similar nonsensical node features during the propagation process. In our work, we propose an Android malware detection approach to enhance node feature differences in an FCG. Firstly, we propose an API-based node feature by which we can visually analyze the behavioral properties of different functions in the app and determine whether their behavior is benign or malicious. Then, we extract the FCG and the features of each function from the decompiled APK file. Next, we calculate the API coefficient inspired by the idea of the TF–IDF algorithm and extract the sensitive function called subgraph (S-FCSG) based on API coefficient ranking. Finally, before feeding the S-FCSG and node features into the GCN model, we add the self-loop for each node of the S-FCSG. A 1-D convolutional neural network and fully connected layers are used for further feature extraction and classification, respectively. The experimental result shows that our approach enhances the node feature differences in an FCG, and the detection accuracy is greater than that of models using other features, suggesting that malware detection based on a graph structure and GNNs has a lot of space for future study.

show abstract

Android Malware Detection Based on Call Graph via Graph Neural Network

Cited by 13 publications

References 11 publications

Robust android malware detection based on subgraph network and denoising GCN network

Robust android malware detection based on subgraph network and denoising GCN network

A Survey on Malware Detection with Graph Representation Learning

An Android Malware Detection Approach to Enhance Node Feature Differences in a Function Call Graph Based on GCNs

Contact Info

Product

Resources

About