Bachelor Thesis BCLR-2023-71

BibliographyHick, Fabian: androGNN: Graph-based Malware Detection for Android Applications.
University of Stuttgart, Faculty of Computer Science, Electrical Engineering, and Information Technology, Bachelor Thesis No. 71 (2023).
53 pages, english.
Abstract

The ever-evolving landscape of Android malware presents a significant challenge in cybersecurity. Recognizing the need for advanced detection methods, this thesis introduces “androGNN,“ a novel approach utilizing Graph Neural Networks (GNNs) for the identification of Android malware based on the success of MalGraph on Windows. The model leverages hierarchical GNNs to analyze the structural semantics of Android applications, using control-flow graphs (CFGs) and function call graphs (FCGs). This research utilizes the combination of CFGs and FCGs in GNN-based malware detection for Android applications, offering a more sophisticated analysis than traditional detection methods. The androGNN model is trained and validated on a comprehensive dataset from the AndroZoo repository, encompassing a realistic distribution of benign and malicious applications. Our model demonstrates superior performance compared to the baseline Drebin approach, particularly in scenarios with stationary conditions. However, it exhibits a notable decline in effectiveness over time due to concept drift, an inherent challenge in the field of malware detection. The findings underscore the potential of GNNs in enhancing malware detection capabilities but also highlight the necessity for models that can adapt to the dynamic nature of malware evolution. The thesis concludes with a discussion on the limitations of the current approach and proposes future research directions, including the integration of additional static features and adversarial training scenarios, to further refine the androGNN model for robust, long-term malware detection in the Android ecosystem.

Department(s)University of Stuttgart, Institute of Software Technology, Software Lab - Program Analysis
Superviser(s)Pradel, Prof. Michael; Cavallaro, Prof. Lorenzo
Entry dateApril 4, 2024
New Report   New Article   New Monograph   Computer Science