SNDGCN: Robust Android malware detection based on subgraph network and denoising GCN network

Android malware seriously affects the use of Android applications, and a growing number of Android malware developers are using adversarial attacks to evade detection by deep learning models. This work proposes an Android malware detection model based on the Android function call graph (FCG) and the denoising graph convolutional network (GCN) that is resistant to adversarial attacks. Methods are also proposed to simplify the FCG to reduce its size, and to construct vertex feature vectors. Because attackers may employ adversarial attack methods, the proposed model uses the subgraph network (SGN) to detect the underlying structural features of the FCG to discover the degree of the obfuscation attack. A denoising graph neural network (GNN) is designed, and the 1-Lipschitz-based neural network denoising method is applied to graph convolution. Moreover, the degree of denoising is adjusted according to the degree of obfuscation, which enhances the robustness of the model. The GCN performs the feature vector extraction of the FCG, and a multilayer perceptron (MLP) is used as the classifier. The results of experiments show that the F1 value of the proposed Android malware detection method is higher than those of other malware detection models for different levels of obfuscation attacks, thus demonstrating its effectiveness against such attacks.