Graph-augmented multi-modal learning framework for robust android malware detection

Area of Science:

• Computer Science
• Cybersecurity
• Artificial Intelligence

Background:

• Android malware poses a significant mobile security challenge due to sophisticated evasion techniques.
• Traditional detection methods struggle with obfuscation and lack multi-domain contextual integration.

Purpose of the Study:

• To introduce GIT-GuardNet, a novel Graph-Informed Transformer Network for precise and robust Android malware detection.
• To leverage multi-modal learning by integrating static code, call graph structures, and temporal behavior.

Main Methods:

• Developed GIT-GuardNet, a network fusing Transformer encoder (static code), Graph Attention Network (call graphs), and Temporal Transformer (behavior).
• Employed a cross-attention fusion mechanism to dynamically weigh inter-modal dependencies for informed decision-making.
• Conducted experiments on a dataset of 15,036 Android applications, including 5,560 malware samples.

Main Results:

• Achieved state-of-the-art performance with 99.85% accuracy, 99.89% precision, and 99.94% AUC.
• Outperformed traditional machine learning, single-view deep networks, and hybrid approaches like DroidFusion.
• Demonstrated strong generalization against obfuscated and stealthy threats with low inference overhead.

Conclusions:

• GIT-GuardNet offers a powerful and extensible framework for intelligent Android malware defense.
• The multi-modal approach and cross-attention fusion significantly enhance detection capabilities.
• The system shows practical applicability for real-world mobile threat detection.