DroidRadar: Android Malware Detection Based on Global Sensitive Graph Embedding
Qige Song, Yongzheng Zhang, Junliang Yao · 2021 IEEE 20th International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom) · 2021
Android application markets face severe threats of malware attacks. Existing learning-based malware detection approaches rely on easily obfuscated features or unscalable sophisticated graph analysis techniques. In this paper, we propose DroidRadar, an accurate Android malware detection system based on lightweight graph embedding. The key insight of our method is constructing an entire Android application collection as a global graph schema and using sensitive APIs as bridge nodes to propagate inter-application information. We conduct statistical correlation analysis from different perspectives to model the application's usage pattern of sensitive APIs, then apply graph convolution network (GCN) to perform node embedding and malware detection. We evaluate DroidRadar on large scale datasets spanning nine years. Results show that DroidRadar has an average detection accuracy of 98.57% and a false-positive rate of 1.4 % on different time periods, which outperforms the state-of-the-art approaches, and it has strong robustness when detecting obfuscated malware variants.