MCGDroid: An Android Malware Classification Method Based on Multi-Feature Class-Call Graph Characterization

Mingkun He

doi:10.1016/j.cose.2025.104713

MCGDroid: An Android Malware Classification Method Based on Multi-Feature Class-Call Graph Characterization

2025-10-16

0

PRE

AI

DOI：10.1016/j.cose.2025.104713

Original

Original request for help

Save

Abstract

En 中文

Malicious software (malware) attacks constitute a major category of security risks affecting the Android operating system. Current Android malware classification approaches exhibit notable limitations: methods that ignore program semantic information often demonstrate suboptimal accuracy and robustness, while techniques leveraging control-flow or data-flow graph representations, though more effective, face computational challenges due to large graph sizes and high overhead. In response to these limitations, MCGDroid is introduced as a novel solution for classifying Android malware, utilizing a representation based on multi-feature class-call graphs. MCGDroid processes disassembled smali code to construct class-call graphs, where nodes are enriched with semantic features including opcodes and sensitive APIs. These class-call graphs, enriched with multiple features, are subsequently processed through a graph convolutional network to carry out malware detection and classification tasks. We confirmed the effectiveness and stability of the proposed method through comprehensive experimental evaluation. The experimental evaluation demonstrates that MCGDroid attains high detection and classification accuracies of 98.92% and 97.02%, respectively, with corresponding F1-scores of 98.54% and 96.65%. When evaluated on the obfuscated test set, the model maintains robust performance, achieving 93.12% detection accuracy and 86.26% classification accuracy.

MCGDroid: An Android Malware Classification Method Based on Multi-Feature Class-Call Graph Characterization

Abstract

Journal

Organization