Bachelorarbeit BCLR-2023-71

Bibliograph.
Daten
Hick, Fabian: androGNN: Graph-based Malware Detection for Android Applications.
Universität Stuttgart, Fakultät Informatik, Elektrotechnik und Informationstechnik, Bachelorarbeit Nr. 71 (2023).
53 Seiten, englisch.
Kurzfassung

The ever-evolving landscape of Android malware presents a significant challenge in cybersecurity. Recognizing the need for advanced detection methods, this thesis introduces “androGNN,“ a novel approach utilizing Graph Neural Networks (GNNs) for the identification of Android malware based on the success of MalGraph on Windows. The model leverages hierarchical GNNs to analyze the structural semantics of Android applications, using control-flow graphs (CFGs) and function call graphs (FCGs). This research utilizes the combination of CFGs and FCGs in GNN-based malware detection for Android applications, offering a more sophisticated analysis than traditional detection methods. The androGNN model is trained and validated on a comprehensive dataset from the AndroZoo repository, encompassing a realistic distribution of benign and malicious applications. Our model demonstrates superior performance compared to the baseline Drebin approach, particularly in scenarios with stationary conditions. However, it exhibits a notable decline in effectiveness over time due to concept drift, an inherent challenge in the field of malware detection. The findings underscore the potential of GNNs in enhancing malware detection capabilities but also highlight the necessity for models that can adapt to the dynamic nature of malware evolution. The thesis concludes with a discussion on the limitations of the current approach and proposes future research directions, including the integration of additional static features and adversarial training scenarios, to further refine the androGNN model for robust, long-term malware detection in the Android ecosystem.

Abteilung(en)Universität Stuttgart, Institut für Softwaretechnologie, Software Lab - Programmanalysen
BetreuerPradel, Prof. Michael; Cavallaro, Prof. Lorenzo
Eingabedatum4. April 2024
   Publ. Informatik