MaskDroid: Robust Android Malware Detection with Masked Graph Representations

Abstract

Translate Article

Android malware attacks have posed a severe threat to mobile users,\nnecessitating a significant demand for the automated detection system. Among\nthe various tools employed in malware detection, graph representations (e.g.,\nfunction call graphs) have played a pivotal role in characterizing the\nbehaviors of Android apps. However, though achieving impressive performance in\nmalware detection, current state-of-the-art graph-based malware detectors are\nvulnerable to adversarial examples. These adversarial examples are meticulously\ncrafted by introducing specific perturbations to normal malicious inputs. To\ndefend against adversarial attacks, existing defensive mechanisms are typically\nsupplementary additions to detectors and exhibit significant limitations, often\nrelying on prior knowledge of adversarial examples and failing to defend\nagainst unseen types of attacks effectively. In this paper, we propose\nMASKDROID, a powerful detector with a strong discriminative ability to identify\nmalware and remarkable robustness against adversarial attacks. Specifically, we\nintroduce a masking mechanism into the Graph Neural Network (GNN) based\nframework, forcing MASKDROID to recover the whole input graph using a small\nportion (e.g., 20%) of randomly selected nodes.This strategy enables the model\nto understand the malicious semantics and learn more stable representations,\nenhancing its robustness against adversarial attacks. While capturing stable\nmalicious semantics in the form of dependencies inside the graph structures, we\nfurther employ a contrastive module to encourage MASKDROID to learn more\ncompact representations for both the benign and malicious classes to boost its\ndiscriminative power in detecting malware from benign apps and adversarial\nexamples.\n