Journal
COMPUTERS & SECURITY
Volume 106, Issue -, Pages -Publisher
ELSEVIER ADVANCED TECHNOLOGY
DOI: 10.1016/j.cose.2021.102264
Keywords
Android malware; Malware detection; Malware familial classification; API Embedding; Graph neural network
Categories
Funding
- Natural Science Foundation of China [U20B2047, 62072421, 62002334]
- Exploration Fund Project of University of Science and Technology of China [YD3480002001]
- Fundamental Research Funds for the Central Universities [WK2100000011]
- National Key Research and Development Program of China [2020YFA0309702]
- Public Service Platform Project for Industrial Technology Foundation [20190089322]
- Anhui Initiative in Quantum Information Technologies [AHY150400]
Ask authors/readers for more resources
The paper introduces a novel approach for Android malware detection and familial classification based on Graph Convolutional Network (GCN). Through experiments, GDroid system shows promising results in detecting Android malware and classifying malware families, outperforming existing methods.
The dramatic increase in the number of malware poses a serious challenge to the Android platform and makes it difficult for malware analysis. In this paper, we propose a novel approach for Android malware detection and familial classification based on the Graph Convolutional Network (GCN). The general idea is to map apps and Android APIs into a large heterogeneous graph, converting the original problem into a node classification task. We build the App-API and API-API edges based on the invocation relationship and the API usage patterns, respectively. The heterogeneous graph is then fed into the GCN model, iteratively generating node embeddings that incorporate topological structure and node features. Eventually, the unlabeled apps are classified by their final embeddings. To our knowledge, this paper is the first study to explore the application of graph neural network in the field of malware classification. We develop a prototype system named GDroid. Experiments show that GDroid can effectively detect 98.99% of Android malware with a low false positive rate of less than 1%, outperforming the existing approaches. It also achieves an average accuracy of almost 97% in the malware familial classification task with surpassing the baselines. Additionally, we cooperate with QI-ANXIN Technology Research Institute to evaluate its real world impact, and GDroid also maintains satisfactory performance in real-world scenarios. (c) 2021 Elsevier Ltd. All rights reserved.
Authors
I am an author on this paper
Click your name to claim this paper and add it to your profile.
Reviews
Recommended
No Data Available