Wasserstein GAN-Based Android Certificate Validation Vulnerability Detection Framework

This paper presents an Android certificate validation vulnerability detection framework that integrates static analysis, adversarial sample training, and optimization via large language models. Centered around the Wasserstein Generative Adversarial Network, the framework aims to enhance the robustness and generalization ability of static detection models against complex and obfuscated attack patterns. Static analysis is performed on 2,000 popular Android applications from the androzoo dataset, with code and configuration features extracted, focusing on certificate-related API usage, permission declarations, and network security settings. Among them, 110 APKs are identified as containing high-risk certificate misconfigurations. Based on these features, a Transformer-based model is constructed for feature vectorization and vulnerability identification. To further improve model robustness, WGAN is employed to generate adversarial samples that mimic real-world evasive vulnerabilities, which are used for adversarial training. Additionally, large language models are used to perform In-Context Learning, enabling semantic filtering, sample refinement, and iterative generator feedback. This results in a closed-loop, self-improving detection pipeline that combines detection, optimization, and feedback. Experimental results across standard, adversarial, and cross-domain scenarios demonstrate that the proposed framework achieves an F1 score of 0.91 and reduces the false positive rate to 7.2%, significantly outperforming traditional static detection tools in both accuracy and resilience.