Visible to the public Graph Embedding Based Familial Analysis of Android Malware using Unsupervised Learning

TitleGraph Embedding Based Familial Analysis of Android Malware using Unsupervised Learning
Publication TypeConference Paper
Year of Publication2019
AuthorsFan, M., Luo, X., Liu, J., Wang, M., Nong, C., Zheng, Q., Liu, T.
Conference Name2019 IEEE/ACM 41st International Conference on Software Engineering (ICSE)
Date PublishedMay 2019
ISBN Number978-1-7281-0869-8
Keywordsanalytical workload, Android malware, application program interfaces, detection algorithms, Face, familial analysis, feature extraction, GefDroid, graph embedding, graph embedding techniques, graph theory, Human Behavior, invasive software, learning (artificial intelligence), Malware, malware analysis, malware link network, Metrics, pattern classification, pattern clustering, privacy, pubcrawl, resilience, Resiliency, security, Semantics, similarity relationships, smart phones, SRA, supervised learning, unsupervised learning

The rapid growth of Android malware has posed severe security threats to smartphone users. On the basis of the familial trait of Android malware observed by previous work, the familial analysis is a promising way to help analysts better focus on the commonalities of malware samples within the same families, thus reducing the analytical workload and accelerating malware analysis. The majority of existing approaches rely on supervised learning and face three main challenges, i.e., low accuracy, low efficiency, and the lack of labeled dataset. To address these challenges, we first construct a fine-grained behavior model by abstracting the program semantics into a set of subgraphs. Then, we propose SRA, a novel feature that depicts the similarity relationships between the Structural Roles of sensitive API call nodes in subgraphs. An SRA is obtained based on graph embedding techniques and represented as a vector, thus we can effectively reduce the high complexity of graph matching. After that, instead of training a classifier with labeled samples, we construct malware link network based on SRAs and apply community detection algorithms on it to group the unlabeled samples into groups. We implement these ideas in a system called GefDroid that performs Graph embedding based familial analysis of AnDroid malware using unsupervised learning. Moreover, we conduct extensive experiments to evaluate GefDroid on three datasets with ground truth. The results show that GefDroid can achieve high agreements (0.707-0.883 in term of NMI) between the clustering results and the ground truth. Furthermore, GefDroid requires only linear run-time overhead and takes around 8.6s to analyze a sample on average, which is considerably faster than the previous work.

Citation Keyfan_graph_2019