Identifying Android Malware Using Fine-Grained Path Information from HIN

As the rapid advances of mobile internet and Internet of Things (IoT), Android has become one of the most widely used operating systems in mobile terminals and IoT devices. However, the massive growth of Android malware poses challenging security problems to these terminals and devices. In this paper, we propose a novel heterogeneous information network (HIN)-based method, called FDroid, for fast and accurate detection of Android malware. Specifically, we first design a fine-grained HIN to model the relationship between APKs and APIs and then extract finer-grained path information, including code blocks, packages and call patterns compared to traditional HIN-based methods, which can effectively improve the detection accuracy without increasing the number of paths. Second, we devise a TF-IWF-based contribution calculation algorithm to select a small number of sensitive APIs calls with high representativeness, which can effectively save the detection time and storage space. Third, we develop an expanded matrix-assisted support vector machine (SVM) classifier for Android malware detection. Experimental results show that the FDroid can achieve 97.43% detection accuracy. Meanwhile, compared with the other related HIN-based malware detection methods, the training time of FDroid is less than 0.1% of them, and the detection time is less than 10% of them.