Android malware detection based on graph attention networks

Abstract:

The explosive growth of Android malware has put forward more efficient and accurate requirements for malware detection methods. In the early years, detection methods were mainly based on features such as permissions and opcode sequences. However, these methods did not fully mine the structural information of programs. The method based on API call graph is one of the mainstream methods. It focuses on capturing structural information and can accurately predict the possible behavior of the application. This paper proposes an Android malware detection method based on graph attention network. The method constructs an API call graph through static analysis to initially characterize the APK, and then introduces the SDNE graph embedding algorithm to learn structural and content features from the API call graph. The attention network fully fuses the neighbor node feature vectors, and then forms the graph embedding for the detection task. The experimental results on the AMD dataset show that the proposed method can effectively detect malware with an accuracy of 97.87% and an F1 score of 97.40%.