Android is undergoing unprecedented malicious threats daily, but the existing methods for malware detection often fail to cope with evolving camouflage in malware. To address this issue, we present HAWK, a new malware detection framework for evolutionary Android applications. We model Android entities and behavioural relationships as a heterogeneous information network (HIN), exploiting its rich semantic metastructures for specifying implicit higher-order relationships. An incremental learning model is created to handle the applications that manifest dynamically, without the need for re-constructing the whole HIN and the subsequent embedding model. The model can pinpoint rapidly the proximity between a new application and existing in-sample applications and aggregate their numerical embeddings under various semantics. Our experiments examine more than 80,860 malicious and 100,375 benign applications developed over a period of seven years, showing that HAWK achieves the highest detection accuracy against baselines and takes only 3.5ms on average to detect an out-of-sample application, with the accelerated training time of 50x faster than the existing approach.
@article{arxiv.2108.07548,
title = {HAWK: Rapid Android Malware Detection through Heterogeneous Graph Attention Networks},
author = {Yiming Hei and Renyu Yang and Hao Peng and Lihong Wang and Xiaolin Xu and Jianwei Liu and Hong Liu and Jie Xu and Lichao Sun},
journal= {arXiv preprint arXiv:2108.07548},
year = {2021}
}