一句话：提出 GefDroid，用图嵌入与无监督社区检测进行 Android 恶意软件家族分析，兼顾准确率与效率。
Android 恶意软件快速增长，严重威胁智能手机用户。家族分析可帮助分析人员聚焦同族样本的共性，降低分析工作量。现有方法多依赖监督学习，存在准确率低、效率低和缺少标注数据等问题。本文先将程序语义抽象为子图，构建细粒度行为模型；再提出 SRA 特征，利用图嵌入刻画子图中敏感 API 调用节点结构角色之间的相似关系，并以向量表示降低图匹配复杂度；最后基于 SRA 构建恶意软件链接网络，用社区检测将未标注样本分组。系统 GefDroid 在三个有真值数据集上取得 NMI 0.707–0.883，平均约 8.6 秒分析一个样本，运行时开销仅线性，且快于先前工作。
The rapid growth of Android malware has posed severe security threats to smartphone users. On the basis of the familial trait of Android malware observed by previous work, the familial analysis is a promising way to help analysts better focus on the commonalities of malware samples within the same families, thus reducing the analytical workload and accelerating malware analysis. The majority of existing approaches rely on supervised learning and face three main challenges, i.e., low accuracy, low efficiency, and the lack of labeled dataset. To address these challenges, we first construct a fine-grained behavior model by abstracting the program semantics into a set of subgraphs. Then, we propose SRA, a novel feature that depicts the similarity relationships between the Structural Roles of sensitive API call nodes in subgraphs. An SRA is obtained based on graph embedding techniques and represented as a vector, thus we can effectively reduce the high complexity of graph matching. After that, instead of training a classifier with labeled samples, we construct malware link network based on SRAs and apply community detection algorithms on it to group the unlabeled samples into groups. We implement these ideas in a system called GefDroid that performs Graph embedding based familial analysis of AnDroid malware using unsupervised learning. Moreover, we conduct extensive experiments to evaluate GefDroid on three datasets with ground truth. The results show that GefDroid can achieve high agreements (0.707-0.883 in term of NMI) between the clustering results and the ground truth. Furthermore, GefDroid requires only linear run-time overhead and takes around 8.6s to analyze a sample on average, which is considerably faster than the previous work.
@inproceedings{FanLLWNZL19,
title = {Graph Embedding Based Familial Analysis of Android Malware using Unsupervised Learning},
author = {Ming Fan and Xiapu Luo and Jun Liu and Meng Wang and Chunyin Nong and Qinghua Zheng and Ting Liu},
booktitle = {ICSE},
year = {2019},
doi = {10.1109/icse.2019.00085}
}