Scholarlink

<p>The popularity of Android smartphones has made them a prime target for cybercriminals, particularly malware authors. Meanwhile, ransomware has emerged as one of the most overwhelming and financially lucrative threats, evolving significantly over the years. Among machine learning techniques, deep learning has had the greatest impact in the field of malware detection in recent years. However, a significant limitation of most existing deep malware detection techniques is their inability to detect unknown or zero-day malware. The ever-increasing growth of zero-day malware and its substantial potential for damage remain paramount concerns for cybersecurity researchers. Graph convolutional neural networks are powerful deep learning models for representation learning on graph data. They model node information as messages and propagate them along the edges of the input graph. In this paper, we present RansomHunter, a novel deep learning technique that combines code representation learning with graph convolutional neural networks in a unified and end-to-end manner to effectively detect zero-day Android ransomware. RansomHunter leverages an attributed sensitive call graph (ASCG) to represent each Android application, where nodes are either sensitive or have at least one common ancestor with a sensitive node. The attribute vector for each node is obtained by applying one-hot encoding to its method name or code embedding to its method body to achieve proper detection performance against zero-day Android ransomware. RansomHunter leverages a layer-wise attention mechanism to learn how much focus should be given to different nodes of the ASCG in each graph convolutional layer. The final embedding of the ASCG is obtained by computing the weighted average of its node embeddings. Experimental results demonstrate that RansomHunter can outperform state-of-the-art techniques, achieving high accuracy in detecting zero-day Android ransomware. This superior performance is due to RansomHunter’s ability to characterize the actual functionality of internal methods by generating code vectors through code embedding. As a result, RansomHunter can potentially detect unknown or zero-day Android ransomware families that share some code snippets with known ransomware variants.</p>

错误：搜索内容不能为空，请输入英文关键词
错误：关键词超出字数限制，请精简
高级检索

RansomHunter: zero-day Android ransomware detection using graph convolutional neural networks and code embeddings

  • 期刊论文

  • 发表日期：

    2025年9月18日

查看全文
  • Mohammad Ebrahimifard,
  • Mahdi Abadi,
  • Fatemeh Deldar

摘要

The popularity of Android smartphones has made them a prime target for cybercriminals, particularly malware authors. Meanwhile, ransomware has emerged as one of the most overwhelming and financially lucrative threats, evolving significantly over the years. Among machine learning techniques, deep learning has had the greatest impact in the field of malware detection in recent years. However, a significant limitation of most existing deep malware detection techniques is their inability to detect unknown or zero-day malware. The ever-increasing growth of zero-day malware and its substantial potential for damage remain paramount concerns for cybersecurity researchers. Graph convolutional neural networks are powerful deep learning models for representation learning on graph data. They model node information as messages and propagate them along the edges of the input graph. In this paper, we present RansomHunter, a novel deep learning technique that combines code representation learning with graph convolutional neural networks in a unified and end-to-end manner to effectively detect zero-day Android ransomware. RansomHunter leverages an attributed sensitive call graph (ASCG) to represent each Android application, where nodes are either sensitive or have at least one common ancestor with a sensitive node. The attribute vector for each node is obtained by applying one-hot encoding to its method name or code embedding to its method body to achieve proper detection performance against zero-day Android ransomware. RansomHunter leverages a layer-wise attention mechanism to learn how much focus should be given to different nodes of the ASCG in each graph convolutional layer. The final embedding of the ASCG is obtained by computing the weighted average of its node embeddings. Experimental results demonstrate that RansomHunter can outperform state-of-the-art techniques, achieving high accuracy in detecting zero-day Android ransomware. This superior performance is due to RansomHunter’s ability to characterize the actual functionality of internal methods by generating code vectors through code embedding. As a result, RansomHunter can potentially detect unknown or zero-day Android ransomware families that share some code snippets with known ransomware variants.