一句话：提出 AMCDroid，用同构图与 AST 神经网络检测 Android 恶意应用，并以多目标遗传算法定位细粒度恶意组件。
现有 Android 恶意软件检测主要关注整个应用是否恶意，缺乏对应用内部恶意组件的细粒度识别。本文提出 AMCDroid：首先基于调用图与代码语句将应用行为建模为同构图，并将图转换为语句树序列，通过基于 AST 的神经网络与特征映射模型 ASTNNF 进行恶意软件检测；若判定为恶意，则进一步在同构图上运行基于多目标遗传算法的细粒度恶意组件检测算法，自适应定位恶意组件。作者在 95,134 个样本上评估，AMCDroid 取得 0.9699 F1，优于两种 SOTA 方法，且在混淆场景下更鲁棒；其细粒度恶意组件检测的平均 F1 比另一 SOTA 方法高 50%。
Existing Android malware detection systems primarily concentrate on detecting malware apps, leaving a gap in the research concerning the detection of malicious components in apps. In this work, we propose a novel approach to detect fine-granularity malicious components for Android apps and build a prototype called AMCDroid. For a given app, AMCDroid first models app behavior to a homogenous graph based on the call graph and code statements of the app. Then, the graph is converted to a statement tree sequence for malware detection through the AST-based Neural Network with Feature Mapping (ASTNNF) model. Finally, if the app is detected as malware, AMCDroid applies fine-granularity malicious component detection (MCD) algorithm which is based on many-objective genetic algorithm to the homogenous graph for detecting malicious component in the app adaptively. We evaluate AMCDroid on 95,134 samples. Compared with the other two state-of-the-art methods in malware detection, AMCDroid gets the highest performance on the test set with 0.9699 F1-Score, and shows better robustness in facing obfuscation. Moreover, AMCDroid is capable of detecting fine-granularity malicious components of (obfuscated) malware apps. Especially, its average F1-Score exceeds another state-of-the-art method by 50%.