.png){kind=icon}
Return
SeGDroid: An Android malware detection method based on sensitive function call graph learning
.png){kind=icon}
PRE
AI
DOI：10.1016/j.eswa.2023.121125.png)
.png){kind=icon}
Original request for help.png){kind=icon}
Share.png){kind=icon}
Save
Abstract
En 中文
Malware is still a challenging security problem in the Android ecosystem, as malware is often obfuscated to evade detection. In such case, semantic behavior feature extraction is crucial for training a robust malware detection model. In this paper, we propose a novel Android malware detection method (named SeGDroid) that focuses on learning the semantic knowledge from sensitive function call graphs (FCGs). Specifically, we devise a graph pruning method to build a sensitive FCG on the base of an original FCG. The method preserves the sensitive API (security-related API) call context and removes the irrelevant nodes of FCGs. We propose a node representation method based on word2vec and social-network-based centrality to extract attributes for graph nodes. Our representation aims at extracting the semantic knowledge of the function calls and the structure of graphs. Using this representation, we induce graph embeddings of the sensitive FCGs associated with node attributes using a graph convolutional neural network algorithm. To provide a model explanation, we further propose a method that calculates node importance. This creates a mechanism for understanding malicious behavior. The experimental results show that SeGDroid achieves an F-score of 98% in the case of malware detection on the CICMal2020 dataset and an F-score of 96% in the case of malware family classification on the MalRadar dataset. In addition, the provided model explanation is able to trace the malicious behavior of the Android malware.
Keywords:
Android malware detection
Function call graph
Graph neural network
Semantic knowledge
Model explanation
Journal
IF:
7.5
Papers:
3.0W
Citations:
10.2W
Organization
Cited Papers
KronoDroid: Time-based Hybrid-featured Dataset for Effective Android Malware Detection and Characterization.png)
COMPUTERS & SECURITY
OAAI
COMPUTERS & SECURITYIF5.4
OAAIShareSaveS3Feature: A static sensitive subgraph-based feature for android malware detectionCOMPUTERS & SECURITY
COMPUTERS & SECURITYIF5.4
PREAI
ShareSaveShareSaveShareSaveShareSaveA survey of malware detection in Android apps: Recommendations and perspectives for future researchCOMPUTER SCIENCE REVIEW
COMPUTER SCIENCE REVIEWIF12.7
PREAI
ShareSaveAndroid malware detection through hybrid features fusion and ensemble classifiers: The AndroPyTool framework and the OmniDroid datasetINFORMATION FUSION
INFORMATION FUSIONIF15.5
PREAI
ShareSaveShareSave
View more