malware detection, hypergraph neural network, hypergraph classification, Technology, Engineering (General). Civil engineering (General), TA1-2040, Biology (General), QH301-705.5, Physics, QC1-999, Chemistry, QD1-999

Android has been the most widely used operating system for mobile phones over the past few years. Malicious attacks against android are a major privacy and security concern. Malware detection techniques for android applications are therefore significant. A class of methods using Function Call Graphs (FCGs) for android malware detection has shown great potential. The relationships between functions are limited to simple binary relationships (i.e., graphs) in these methods. However, one function often calls several other functions to produce specific effects in android applications, which cannot be captured with FCGs. In this paper, we propose to formalize android malware detection as a hypergraph-level classification task. A hypergraph is a topology capable of portraying complex relationships between multiple vertices, which can better characterize the functional behavior of android applications. We model android applications using hypergraphs and extract the embedded features of android applications using hypergraph neural networks to represent the functional behavior of android applications. Hypergraph neural networks can encode high-order data correlation in a hypergraph structure for data representation learning. In experiments, we validate the gaining effect of hypergraphs on detection performance across two open-source android application datasets. Especially, HGNNP obtains the best classification performance of 91.10% on the Malnet-Tiny dataset and 97.1% on the Drebin dataset, which outperforms all baseline methods.