With the widespread usage of Android smartphones in our daily lives, the Android platform has become an attractive target for malware authors. There is an urgent need for developing an automatic malware detection approach to prevent the spread of malware. The low code coverage and poor efficiency of the dynamic analysis limit the large-scale deployment of malware detection methods based on dynamic features. Therefore, researchers have proposed a plethora of detection approaches based on abundant static features to provide efficient malware detection. This paper explores the direction of Android malware detection based on graph representation learning. Without complex feature graph construction, we propose a new Android malware detection approach based on lightweight static analysis via the graph neural network (GNN). Instead of directly extracting Application Programming Interface (API) call information, we further analyze the source code of Android applications to extract high-level semantic information, which increases the barrier of evading detection. Particularly, we construct approximate call graphs from function invocation relationships within an Android application to represent this application and further extract intrafunction attributes, including required permission, security level, and Smali instructions’ semantic information via Word2Vec, to form the node attributes within graph structures. Then, we use the graph neural network to generate a vector representation of the application, and then malware detection is performed on this representation space. We conduct experiments on real-world application samples. The experimental results demonstrate that our approach implements high effective malware detection and outperforms state-of-the-art detection approaches.

中文翻译：

---

基于图表示学习的 Android 恶意软件检测

随着 Android 智能手机在我们日常生活中的广泛使用，Android 平台已成为恶意软件作者的一个有吸引力的目标。迫切需要开发一种自动恶意软件检测方法来防止恶意软件的传播。动态分析的低代码覆盖率和低效率限制了基于动态特征的恶意软件检测方法的大规模部署。因此，研究人员提出了大量基于丰富静态特征的检测方法，以提供有效的恶意软件检测。本文探讨了基于图表示学习的Android恶意软件检测方向。在没有复杂的特征图构建的情况下，我们提出了一种新的基于轻量级静态分析的 Android 恶意软件检测方法，通过图神经网络 (GNN)。我们没有直接提取应用程序编程接口（API）调用信息，而是进一步分析Android应用程序的源代码以提取高级语义信息，这增加了逃避检测的障碍。特别是，我们从Android应用程序内部的函数调用关系中构建近似调用图来表示该应用程序，并通过Word2Vec进一步提取函数内属性，包括所需权限、安全级别和Smali指令的语义信息，以形成图结构中的节点属性。然后，我们使用图神经网络生成应用程序的向量表示，然后在这个表示空间上进行恶意软件检测。我们对真实世界的应用程序样本进行实验。