Android Malware Detection via Graph Representation Learning

Abstract

With the widespread usage of Android smartphones in our daily lives, the Android platform has become an attractive target for malware authors. There is an urgent need for developing an automatic malware detection approach to prevent the spread of malware. The low code coverage and poor efficiency of the dynamic analysis limit the large-scale deployment of malware detection methods based on dynamic features. Therefore, researchers have proposed a plethora of detection approaches based on abundant static features to provide efficient malware detection. This paper explores the direction of Android malware detection based on graph representation learning. Without complex feature graph construction, we propose a new Android malware detection approach based on lightweight static analysis via the graph neural network (GNN). Instead of directly extracting Application Programming Interface (API) call information, we further analyze the source code of Android applications to extract high-level semantic information, which increases the barrier of evading detection. Particularly, we construct approximate call graphs from function invocation relationships within an Android application to represent this application and further extract intrafunction attributes, including required permission, security level, and Smali instructions’ semantic information via Word2Vec, to form the node attributes within graph structures. Then, we use the graph neural network to generate a vector representation of the application, and then malware detection is performed on this representation space. We conduct experiments on real-world application samples. The experimental results demonstrate that our approach implements high effective malware detection and outperforms state-of-the-art detection approaches.

Complementary multi-modality molecular self-supervised learning via non-overlapping masking for property prediction

“…Most existing approaches often rely on the contrastive method, such as SMICLR [ 35 ], DVMP [ 21 ] and MOCO [ 24 ], which focus on the same two modalities as we do but they neglect the fine-grained interactions across different modalities. A concurrent work, UniMAP [ 36 ], is a generative pre-training based on mask reconstruction, but it only performs simple mask reconstruction without a specific design of masking strategy, so it still cannot fully leverage the complementary information interactions. We introduce a non-overlapping masking strategy to force cross-modality information interaction, thereby having a greater advantage.…”

Mobile based Malware Detection using Artificial Intelligence Techniques a review

“…The authors suggest using Word2Vec and GNN algorithms to extract ultrafunction semantic and interfunction structure information automatically for efficient malware identification. [24] The research recommends combining FT and SigPID into DREBIN to enhance the efficiency of running time and the accuracy of malware detection. Future research will examine this integration.…”

EAODroid: Android Malware Detection Based on Enhanced API Order

“…Using functions including API calls as graph node is more flexible. Cai et al [33] and Feng et al [34] both convert the function nodes in FCG into vector form. The former is based on word embedding, and the latter one extracts internal attributes of function as features.…”