Android Malware Detection Using Heterogeneous Graph Meta-Paths
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing malware detection methods for Android systems fail to capture deep semantics intentionally hidden and evolved, struggle to effectively detect varied malware, and suffer from low correlation between entity relationships and malicious behavior, leading to missed or false detections.
Innovation Solution
A method utilizing a heterogeneous graph to construct meta-paths with a KL distance threshold, followed by RBM feature fusion and automatic encoder adjustment to generate fusion feature vectors, which are then classified using a DNN for accurate malware detection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If machine learning methods with vectors are used to characterize application software, then classification can be performed, but deep semantics intentionally hidden and evolved cannot be acquired
Solution Approach 1:
The patent transitions from traditional vector-based flat representation to heterogeneous graph structure with multiple dimensions (nodes, edges, meta-paths, subgraphs). This dimensional expansion enables capturing deep semantics by representing complex relationships between Android components, APIs, and permissions that vectors cannot express, thereby resolving the contradiction between detection accuracy and information loss.
Solution Approach 2:
The patent employs nested graph structures where subgraphs are embedded within larger heterogeneous graphs. Multiple layers of graph representations (component graphs, API graphs, permission graphs) are nested to progressively capture deeper semantic information, allowing the system to acquire hidden semantics while maintaining detection accuracy.
2Adaptability or versatility
If homogeneous or heterogeneous graph structures are used to represent application features, then richer application depiction is achieved, but entity relationship correlation with malicious behavior remains low
Solution Approach 1:
The patent segments the heterogeneous graph into multiple specialized subgraphs (Android component graphs, API call graphs, permission graphs) that each capture specific aspects of application behavior. This segmentation allows focused analysis of malicious patterns in each domain while maintaining overall adaptability, thereby improving both depiction richness and behavioral correlation.
Solution Approach 2:
The patent introduces meta-paths as intermediary structures that connect different entity types (components, APIs, permissions) through meaningful relationship sequences. These meta-paths serve as mediators that enhance the correlation between entity relationships and malicious behavior by capturing multi-hop semantic patterns that direct edges cannot represent.
3Adaptability or versatility
If current graph methods are used, then application features can be expressed, but detection can be bypassed by confusing or replacing entities
Solution Approach 1:
The patent performs preliminary graph construction and meta-path extraction before malware detection, establishing a robust structural framework that captures intrinsic relationships between entities. This preliminary action creates a stable representation that is resistant to confusion or replacement attacks, as the multi-dimensional graph structure reveals underlying semantic patterns that cannot be easily spoofed.
Solution Approach 2:
The patent combines multiple graph types (component graphs, API graphs, permission graphs) into a composite heterogeneous graph structure. This composite structure integrates diverse information sources and relationship types, creating a detection system that is more robust to evasion techniques since malware would need to simultaneously manipulate multiple graph dimensions to succeed.
4Measurement precision
If user-sensitive information is input as features, then detection features are enhanced, but risk of information leakage occurs
Solution Approach 1:
The patent extracts and processes user-sensitive information through the heterogeneous graph structure, transforming raw sensitive data into aggregated graph features (node degrees, path counts, subgraph patterns). This extraction process separates the detection value from the sensitive content, maintaining detection precision while reducing information leakage risk by not directly using raw sensitive information as features.
Data Source
AI summary
A method of detecting Android malware based on a heterogeneous graph and an apparatus thereof are provided, including: constructing a target heterogeneous graph according to entities and entity relationship information extracted from an application to be tested; determining a KL distance between any two meta-paths, and taking the meta-paths in which the KL distance is greater than a preset threshold as a plurality of finally selected meta-paths; carrying out, by RBM, feature fusion on the plurality of meta-paths, and adjusting, by an automatic encoder, fusion parameters of initial fusion vectors to meet a predetermined condition to obtain a plurality of fusion feature vectors; inputting the plurality of fusion feature vectors into a trained Deep Neural Network (DNN) for classification to obtain a final classification result, and determining whether the application to be tested is Android malware according to the final classification result.