Robust Android Malware Detection Based on Attributed Heterogenous Graph Embedding

While Machine learning is widely used in Android malware detection, it has been shown that machine learning based malware detection is vulnerable to adversarial attacks. Existing defense methods improve robustness at the cost of decrease in accuracy. In this paper, we propose a Heterogeneous Graph Embedding Malware Detection method, called HGEMD. It could improve both accuracy and robustness by making use of relations between apps. Specifically, we firstly extract API calls from the individual app as attribute and auxiliary information (i.e., permission, third-party library) from massive apps to construct relations. Then, we build an Attributed Heterogeneous Graph (AHG) to simultaneously model attribute and relations. Furthermore, we adopt graph convolution network and attention mechanism to fuse above heterogeneous information. Experimental results on large-scale dataset collected from Google Play demonstrate that the proposed method outperforms the state-of-the-art methods in the respect of accuracy and robustness.