Malware detection framework based on graph variational autoencoder extracted embeddings from API-call graphs.

Area of Science:

• Cybersecurity
• Machine Learning
• Software Engineering

Background:

• Malware poses significant threats to data confidentiality and integrity, causing substantial damages.
• Existing malware detection methods require robust feature extraction and selection techniques.

Purpose of the Study:

• To propose and evaluate a novel malware detection model utilizing API-call graphs and Graph Variational Autoencoder (GVAE).
• To assess the efficacy of GVAE in reducing feature dimensionality for improved malware classification.
• To compare GVAE-based feature reduction with traditional methods like Recursive Feature Elimination (RFE) and Fisher Score (FS).

Main Methods:

• Extraction of API-call graphs from Android apk files.
• Application of Graph Variational Autoencoder (GVAE) for dimensionality reduction of graph node features.
• Classification using Support Vector Machine (SVM) and LightGBM models with GVAE-reduced embeddings.
• Validation using RFE and FS for feature selection and comparison.

Main Results:

• GVAE-reduced embeddings improved accuracy by approximately 4% in both SVM and LightGBM models.
• The combination of RFE feature selection and GVAE embeddings achieved the highest accuracy of 0.967 with LightGBM.
• RFE and FS methods, when used alone, identified feature sets that yielded high performance, with LightGBM and RFE-selected 50 features reaching 0.907 accuracy and 0.852 F-measure.

Conclusions:

• GVAE effectively reduces feature dimensionality while preserving crucial information for malware detection.
• Combining GVAE with feature selection techniques like RFE offers superior performance compared to using GVAE or RFE alone.
• The proposed model demonstrates a promising approach for accurate and efficient Android malware detection.