WHGDroid: Effective android malware detection based on weighted heterogeneous graph

• Published in: Journal of information security and applications 2023-09, Vol.77, p.103556, Article 103556
• Main Authors: Huang, Lu, Xue, Jingfeng, Wang, Yong, Liu, Zhenyan, Chen, Junbao, Kong, Zixiao
• Format: Article
• Language: English
• Subjects: Android malware detection; Graph neural network; Graph representation learning; Heterogeneous graph; Mobile application security; Model aging
• ISSN: 2214-2126
• DOI: 10.1016/j.jisa.2023.103556

The growing Android malware is seriously threatening the privacy and property security of Android users. However, the existing detection methods are often unable to maintain sustainability as Android malwares evolve. To address this issue, instead of directly using the intra-App feature, we exploit diverse inter-App relations to build a higher-level semantic association, making it more difficult for malware to evade detection. In this paper, we propose WHGDroid, a new malware detection framework based on weighted heterogeneous graph, which helps detect malware by implicit higher-level semantic connectivity across Apps. To comprehensively analyze Apps, we first extract five different Android entities and five relations, and then model the entities and relations among them into a weighted heterogeneous graph (WHG), in which weights are used to represent the importance of entities. Rich-semantic metapaths are proposed to establish the implicit associations between App nodes and derive homogeneous graphs containing only App nodes. Finally, graph neural network is used to learn the numerical embedding representations of Apps. We make a comprehensive comparison with five baseline methods on large datasets in different read scenarios. The experimental results show that WHGDroid is superior to two state-of-the-art methods in all cases.