.png){kind=icon}
返回
SeGDroid: An Android malware detection method based on sensitive function call graph learning
.png){kind=icon}
PRE
AI
DOI：10.1016/j.eswa.2023.121125.png)
.png){kind=icon}
原文求助.png){kind=icon}
分享.png){kind=icon}
收藏
摘要
En 中文
Malware is still a challenging security problem in the Android ecosystem, as malware is often obfuscated to evade detection. In such case, semantic behavior feature extraction is crucial for training a robust malware detection model. In this paper, we propose a novel Android malware detection method (named SeGDroid) that focuses on learning the semantic knowledge from sensitive function call graphs (FCGs). Specifically, we devise a graph pruning method to build a sensitive FCG on the base of an original FCG. The method preserves the sensitive API (security-related API) call context and removes the irrelevant nodes of FCGs. We propose a node representation method based on word2vec and social-network-based centrality to extract attributes for graph nodes. Our representation aims at extracting the semantic knowledge of the function calls and the structure of graphs. Using this representation, we induce graph embeddings of the sensitive FCGs associated with node attributes using a graph convolutional neural network algorithm. To provide a model explanation, we further propose a method that calculates node importance. This creates a mechanism for understanding malicious behavior. The experimental results show that SeGDroid achieves an F-score of 98% in the case of malware detection on the CICMal2020 dataset and an F-score of 96% in the case of malware family classification on the MalRadar dataset. In addition, the provided model explanation is able to trace the malicious behavior of the Android malware.
Keyword:
Android malware detection
Function call graph
Graph neural network
Semantic knowledge
Model explanation
期刊
IF:
7.5
论文数:
3.0W
被引数:
10.2W
机构
引用论文
KronoDroid: Time-based Hybrid-featured Dataset for Effective Android Malware Detection and CharacterizationKronoDroid: 基于时间的混合特征数据集，用于有效的Android恶意软件检测和表征.png)
COMPUTERS & SECURITY
OAAI
COMPUTERS & SECURITYIF5.4
OAAI分享收藏S3Feature: A static sensitive subgraph-based feature for android malware detectionS3Feature: 基于静态敏感子图的android恶意软件检测功能COMPUTERS & SECURITY
COMPUTERS & SECURITYIF5.4
PREAI
分享收藏DroidMalwareDetector: A novel Android malware detection framework based on convolutional neural networkDroidMalwareDetector: 一种基于卷积神经网络的Android恶意软件检测框架
PREAI
分享收藏A survey of malware detection in Android apps: Recommendations and perspectives for future researchAndroid应用程序中恶意软件检测的调查: 未来研究的建议和观点COMPUTER SCIENCE REVIEW
COMPUTER SCIENCE REVIEWIF12.7
PREAI
分享收藏Android malware detection through hybrid features fusion and ensemble classifiers: The AndroPyTool framework and the OmniDroid dataset通过混合功能融合和集成分类器进行Android恶意软件检测: AndroPyTool框架和OmniDroid数据集INFORMATION FUSION
INFORMATION FUSIONIF15.5
PREAI
分享收藏
查看更多内容