Android Malware Detection via Graph Representation Learning

<table class="table-group" id="tab7"><tr><td><table class="table"><tr><td class="thead-hr" colspan="6"><hr/></td></tr><tr class="thead"><td class="align_left">Step</td><td class="align_center">Disassembly</td><td class="align_center">Call graph extraction</td><td class="align_center">Function attribute extraction</td><td class="align_center">Graph embedding</td><td class="align_center">MLP classification</td></tr><tr><td class="thead-hr" colspan="6"><hr/></td></tr><tr><td class="align_left">Avg. time (s)</td><td class="align_center">3.76s</td><td class="align_center">8.93</td><td class="align_center"><span style="width: 58.3897ptpx;"><svg height="11.9413pt" id="M107" style="vertical-align:-0.3499002pt" version="1.1" viewbox="-0.0498162 -11.5914 58.3897 11.9413" width="58.3897pt" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"><g transform="matrix(.013,0,0,-0.013,0,0)"><path d="M285 378C315 398 338 416 353 432C373 451 384 474 384 503C384 579 325 635 236 635H235C182 635 136 610 108 579L65 516L85 496C110 533 150 575 205 575C258 575 300 543 300 481C300 407 232 369 141 339L147 310C163 315 188 321 211 321C268 321 338 284 338 192C338 94 288 40 217 40C160 40 119 68 93 91C85 98 77 97 69 91C60 84 47 71 46 58C44 46 48 35 62 22C75 10 116 -12 162 -12C234 -12 424 62 424 224C424 297 373 359 285 376V378Z"></path></g><g transform="matrix(.013,0,0,-0.013,6.24,0)"><path d="M113 -12C146 -12 170 11 170 46C170 78 146 103 114 103S58 78 58 46C58 11 82 -12 113 -12Z"></path></g><g transform="matrix(.013,0,0,-0.013,9.204,0)"><path d="M153 550H386L412 615L406 623H120L82 318C104 327 142 338 184 338C294 338 347 275 347 187C347 112 305 39 221 39C160 39 119 71 97 89C88 97 80 96 71 90C59 80 50 67 49 57C48 45 52 36 66 23C80 9 123 -12 169 -12C221 -11 288 15 342 59C403 109 431 165 431 225C431 308 366 395 238 395C212 395 165 379 127 364L153 550Z"></path></g><g transform="matrix(.013,0,0,-0.013,15.444,0)"><path d="M249 635C141 635 70 555 70 471C70 401 114 353 179 316C143 294 106 267 90 252C68 231 45 202 45 157C45 50 130 -12 237 -12C322 -12 435 52 435 169C435 256 372 304 303 343C349 374 375 398 383 407C401 429 411 458 411 487C411 569 344 635 249 635ZM238 603C285 603 337 567 337 482C337 422 310 385 276 358C205 393 145 426 145 500C145 552 179 603 238 603ZM248 20C183 20 125 70 125 163C125 218 158 268 206 300C284 261 355 217 355 143C355 66 308 20 248 20Z"></path></g><g transform="matrix(.013,0,0,-0.013,24.59,0)"><path d="M528 54L331 254L528 455L492 493L294 291L96 493L60 455L257 254L60 54L96 16L294 217L492 16L528 54Z"></path></g><g transform="matrix(.013,0,0,-0.013,35.126,0)"><path d="M384 0V27C293 34 287 42 287 114V635C232 613 172 594 109 583V559L157 557C201 555 205 550 205 499V114C205 42 199 34 109 27V0H384Z"></path></g><g transform="matrix(.013,0,0,-0.013,41.366,0)"><path d="M241 635C89 635 35 457 35 312C35 153 89 -12 240 -12C390 -12 443 166 443 312C443 466 390 635 241 635ZM238 602C329 602 354 454 354 312C354 172 330 22 240 22C152 22 124 173 124 313S148 602 238 602Z"></path></g><g transform="matrix(.0091,0,0,-0.0091,47.653,-5.741)"><path d="M556 236V289H56V236H556Z"></path></g><g transform="matrix(.0091,0,0,-0.0091,53.213,-5.741)"><path d="M290 377C321 398 342 415 358 430C378 450 389 473 389 502C389 578 329 635 238 635H237C184 635 137 610 109 578L64 515L88 493C112 529 154 573 208 573S303 542 303 482C303 409 233 370 141 341L149 308C165 313 190 319 215 319C272 319 341 283 341 193C342 98 292 43 222 43C163 43 122 72 96 94C88 101 79 100 70 94C61 87 47 73 46 60C44 47 48 37 62 23C76 10 118 -12 165 -12C238 -12 430 62 430 223C430 297 379 359 290 375V377Z"></path></g></svg></span></td><td class="align_center">0.26</td><td class="align_center"><span style="width: 58.3897ptpx;"><svg height="11.9413pt" id="M108" style="vertical-align:-0.3499002pt" version="1.1" viewbox="-0.0498162 -11.5914 58.3897 11.9413" width="58.3897pt" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"><g transform="matrix(.013,0,0,-0.013,0,0)"><path d="M384 0V27C293 34 287 42 287 114V635C232 613 172 594 109 583V559L157 557C201 555 205 550 205 499V114C205 42 199 34 109 27V0H384Z"></path></g><g transform="matrix(.013,0,0,-0.013,6.24,0)"><path d="M113 -12C146 -12 170 11 170 46C170 78 146 103 114 103S58 78 58 46C58 11 82 -12 113 -12Z"></path></g><g transform="matrix(.013,0,0,-0.013,9.204,0)"><path d="M137 343C167 482 260 545 321 574C357 591 397 603 429 609L423 641C382 634 335 622 295 608C189 570 37 457 37 238C37 84 125 -12 242 -12C362 -12 447 89 447 209C447 311 374 393 267 393C247 393 226 386 204 376L137 343ZM227 337C318 337 361 256 361 173C361 105 336 22 258 22C176 22 126 120 126 240C126 266 127 291 132 310C155 323 189 337 227 337Z"></path></g><g transform="matrix(.013,0,0,-0.013,15.444,0)"><path d="M285 378C315 398 338 416 353 432C373 451 384 474 384 503C384 579 325 635 236 635H235C182 635 136 610 108 579L65 516L85 496C110 533 150 575 205 575C258 575 300 543 300 481C300 407 232 369 141 339L147 310C163 315 188 321 211 321C268 321 338 284 338 192C338 94 288 40 217 40C160 40 119 68 93 91C85 98 77 97 69 91C60 84 47 71 46 58C44 46 48 35 62 22C75 10 116 -12 162 -12C234 -12 424 62 424 224C424 297 373 359 285 376V378Z"></path></g><g transform="matrix(.013,0,0,-0.013,24.59,0)"><path d="M528 54L331 254L528 455L492 493L294 291L96 493L60 455L257 254L60 54L96 16L294 217L492 16L528 54Z"></path></g><g transform="matrix(.013,0,0,-0.013,35.126,0)"><path d="M384 0V27C293 34 287 42 287 114V635C232 613 172 594 109 583V559L157 557C201 555 205 550 205 499V114C205 42 199 34 109 27V0H384Z"></path></g><g transform="matrix(.013,0,0,-0.013,41.366,0)"><path d="M241 635C89 635 35 457 35 312C35 153 89 -12 240 -12C390 -12 443 166 443 312C443 466 390 635 241 635ZM238 602C329 602 354 454 354 312C354 172 330 22 240 22C152 22 124 173 124 313S148 602 238 602Z"></path></g><g transform="matrix(.0091,0,0,-0.0091,47.653,-5.741)"><path d="M556 236V289H56V236H556Z"></path></g><g transform="matrix(.0091,0,0,-0.0091,53.213,-5.741)"><path d="M290 377C321 398 342 415 358 430C378 450 389 473 389 502C389 578 329 635 238 635H237C184 635 137 610 109 578L64 515L88 493C112 529 154 573 208 573S303 542 303 482C303 409 233 370 141 341L149 308C165 313 190 319 215 319C272 319 341 283 341 193C342 98 292 43 222 43C163 43 122 72 96 94C88 101 79 100 70 94C61 87 47 73 46 60C44 47 48 37 62 23C76 10 118 -12 165 -12C238 -12 430 62 430 223C430 297 379 359 290 375V377Z"></path></g></svg></span></td></tr><tr><td class="align_left">Avg. memory (MB)</td><td class="align_center">15.2</td><td class="align_center">26.8</td><td class="align_center">0.4</td><td class="align_center">63.5</td><td class="align_center">7.8</td></tr><tr class="table-tr"><td colspan="6"><hr class="tbody-hr"/></td></tr></table></td></tr></table>

<div>Time and memory costs of each step of CGDroid.</div>

Mobile Information Systems

tab7

Table 7

Table 7: Android Malware Detection via Graph Representation Learning 