HertDroid: Android Malware Detection Method with Influential Node Filter and Heterogeneous Graph Transformer
Source abstract
Abstract
The explosive growth of malware targeting Android devices has resulted in the demand for the acquisition and integration of comprehensive information to enable effective, robust, and user-friendly malware detection. In response to this challenge, this paper introduces HertDroid, an innovative Android malware detection method that leverages the hidden contextual information within application entities. Specifically, we formulate a heterogeneous graph encapsulating rich semantics of entities and their interactions to model the behavior of Android applications. To alleviate computational burdens, a filter is implemented to identify nodes containing crucial information. The Transformer architecture is then deployed for efficient information aggregation across diverse entities. In our experiments, HertDroid demonstrates superior performance by achieving the highest F1 scores when compared to baseline methods on a dataset comprising 10,361 benign and 11,043 malicious apps. Notably, HertDroid excels in maintaining a lightweight profile, and its performance is achieved without the necessity of manual meta-path configuration.
Source: crossref · Quality: baseline
Research context
OpenAlex topics: Advanced Malware Detection Techniques · Network Security and Intrusion Detection · Spam and Phishing Detection
SciVX discovery tags are terminology-based. OpenAlex topics are source-provided classifications.
Affiliations
School of Computer and Electronics Information, Guangxi University, Nanning 530004, China
Guangxi Colleges and Universities Key Laboratory of Multimedia Communications and Information Processing, Guangxi University, Nanning 530004, China
Funding
National Natural Science Foundation of China (NSFC)
References (51)
Show source-provided references
1. Statcounter (2024, February 10). Available online: https://gs.statcounter.com/os-market-share/mobile/worldwide/#yearly-2023-2023-bar.
2. DroidRL: Feature selection for android malware detection with reinforcement learning10.1016/j.cose.2023.103126 ↗
3. Malicious application detection in android—A systematic literature review10.1016/j.cosrev.2021.100373 ↗
4. A systematic literature review of android malware detection using static analysis10.1109/ACCESS.2020.3002842 ↗
5. Orchestration of APT malware evasive manoeuvers employed for eluding anti-virus and sandbox defense10.1016/j.cose.2022.102627 ↗
6. A novel permission-based Android malware detection system using feature selection based on linear regression
7. Permpair: Android malware detection using permission pairs10.1109/TIFS.2019.2950134 ↗
8. Mohamad Arif, J., Ab Razak, M.F., Awang, S., Tuan Mat, S.R., Ismail, N.S.N., and Firdaus, A. (2021). A static analysis approach for Android permission-based malware detection systems. PLoS ONE, 16.10.1371/journal.pone.0257968 ↗
9. Android malware detection using complex-flows10.1109/TMC.2018.2861405 ↗
10. Deep learning for effective Android malware detection using API call graph embeddings10.1007/s00500-019-03940-5 ↗
11. Opcode sequence analysis of Android malware by a convolutional neural network10.1002/cpe.5308 ↗
12. Android malware obfuscation variants detection method based on multi-granularity opcode features10.1016/j.future.2021.11.005 ↗
13. Graph neural networks: A review of methods and applications10.1016/j.aiopen.2021.01.001 ↗
14. Kipf, T.N., and Welling, M. (2016). Semi-supervised classification with graph convolutional networks. arXiv.
15. A comprehensive survey on graph neural networks10.1109/TNNLS.2020.2978386 ↗
16. Graph convolutional networks: A comprehensive review10.1186/s40649-019-0069-y ↗
17. BejaGNN: Behavior-based Java Malware Detection via Graph Neural Network10.1007/s11227-023-05243-x ↗
18. Velikovi, P., Cucurull, G., Casanova, A., Romero, A., Lio, P., and Bengio, Y. (2017). Graph attention networks. arXiv.
19. GDroid: Android malware detection and classification with graph convolutional network10.1016/j.cose.2021.102264 ↗
20. Hou, S., Ye, Y., Song, Y., and Abdulhayoglu, M. (2017, January 13–17). Hindroid: An intelligent android malware detection system based on structured heterogeneous information network. Proceedings of the 23rd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, Halifax, NS, Canada.10.1145/3097983.3098026 ↗
21. Hawk: Rapid android malware detection through heterogeneous graph attention networks10.1109/TNNLS.2021.3105617 ↗
22. Ye, Y., Hou, S., Chen, L., Lei, J., Wan, W., Wang, J., Xiong, Q., and Shao, F. (2019, January 10–16). Out-of-sample node representation learning for heterogeneous graph in real-time android malware detection. Proceedings of the 28th International Joint Conference on Artificial Intelligence (IJCAI), Macao, China.10.24963/ijcai.2019/576 ↗
23. Hu, Z., Dong, Y., Wang, K., and Sun, Y. (2020, January 20–24). Heterogeneous graph transformer. Proceedings of the Web Conference 2020, Taipei, Taiwan.10.1145/3366423.3380027 ↗
24. Yang, X., Yan, M., Pan, S., Ye, X., and Fan, D. (2023, January 7–14). Simple and efficient heterogeneous graph neural network. Proceedings of the AAAI Conference on Artificial Intelligence, Washington, DC, USA.
25. Pathsim: Meta path-based top-k similarity search in heterogeneous information networks10.14778/3402707.3402736 ↗
26. (2023, April 10). Androguard. Available online: https://github.com/androguard/androguard.
27. (2023, April 13). Neo4j. Available online: https://github.com/neo4j/neo4j.
28. Fey, M., and Lenssen, J.E. (2019). Fast graph representation learning with PyTorch Geometric. arXiv.
29. Group decision-making based on complex spherical fuzzy VIKOR approach10.1016/j.knosys.2021.106793 ↗
30. Riondato, M., and Kornaropoulos, E.M. (2014, January 24–28). Fast approximation of betweenness centrality through sampling. Proceedings of the 7th ACM International Conference on Web Search and Data Mining, New York, NY, USA.10.1145/2556195.2556224 ↗
31. Angriman, E., van der Grinten, A., Hamann, M., Meyerhenke, H., and Penschuck, M. (2023). Algorithms for Big Data: DFG Priority Program 1736, Springer Nature.
32. Misra, D. (2020, January 7–10). Mish: A Self Regularized Non-Monotonic Activation Function. Proceedings of the British Machine Vision Conference, Virtual.
33. Allix, K., Bissyand, T.F., Klein, J., and Le Traon, Y. (2016, January 14–15). Androzoo: Collecting millions of android apps for the research community. Proceedings of the 13th International Conference on Mining Software Repositories, Austin, TX, USA.10.1145/2901739.2903508 ↗
34. VirusShare (2023, April 05). Available online: https://virusshare.com.
35. (2023, April 10). APKtool. Available online: https://github.com/iBotPeaches/Apktool.
36. Brody, S., Alon, U., and Yahav, E. (2021). How attentive are graph attention networks?. arXiv.
37. Hamilton, W., Ying, Z., and Leskovec, J. (2017, January 4–9). Inductive representation learning on large graphs. Proceedings of the 31st International Conference on Neural Information Processing Systems, Long Beach, CA, USA.
38. Wang, X., Ji, H., Shi, C., Wang, B., Ye, Y., Cui, P., and Yu, P.S. (2019, January 13–17). Heterogeneous graph attention network. Proceedings of the world Wide Web Conference, San Francisco, CA, USA.10.1145/3308558.3313562 ↗
39. Dong, Y., Chawla, N.V., and Swami, A. (2017, January 13–17). metapath2vec: Scalable representation learning for heterogeneous networks. Proceedings of the 23rd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, Halifax, NS, Canada.10.1145/3097983.3098036 ↗
40. Schlichtkrull, M., Kipf, T.N., Bloem, P., Van Den Berg, R., Titov, I., and Welling, M. (2018, January 3–7). Modeling relational data with graph convolutional networks. Proceedings of the Semantic Web: 15th International Conference, ESWC 2018, Heraklion, Crete, Greece. Proceedings 15.10.1007/978-3-319-93417-4_38 ↗
41. Xu, K., Li, Y., Deng, R., Chen, K., and Xu, J. (2019, January 17–19). Droidevolver: Self-evolving android malware detection system. Proceedings of the 2019 IEEE European Symposium on Security and Privacy (EuroS&P), Stockholm, Sweden.10.1109/EuroSP.2019.00014 ↗
42. Loshchilov, I., and Hutter, F. (2017). Decoupled weight decay regularization. arXiv.
43. Pytorch (2023, April 13). Available online: https://pytorch.org/.
44. Pandas (2023, April 13). Available online: https://pandas.pydata.org/.
45. Matplotlib (2023, April 13). Available online: https://matplotlib.org/.
46. Chen, D., Lin, Y., Li, W., Li, P., Zhou, J., and Sun, X. (2020, January 7–12). Measuring and relieving the over-smoothing problem for graph neural networks from the topological view. Proceedings of the AAAI Conference on Artificial Intelligence, New York, NY, USA.10.1609/aaai.v34i04.5747 ↗
47. Zhang, C., Song, D., Huang, C., Swami, A., and Chawla, N.V. (2019, January 4–8). Heterogeneous graph neural network. Proceedings of the 25th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining, Anchorage, AK, USA.10.1145/3292500.3330961 ↗
48. Understanding graph embedding methods and their applications10.1137/20M1386062 ↗
49. A comprehensive survey of graph embedding: Problems, techniques, and applications10.1109/TKDE.2018.2807452 ↗
50. Graph embedding techniques, applications, and performance: A survey10.1016/j.knosys.2018.03.022 ↗
51. Visualizing data using t-SNE