Scholarlink

The ongoing evolution of Android malware has witnessed malicious applications transitioning from single-purpose to multifaceted attack vectors, posing significant threats to user privacy and device security. While numerous classification methodologies have been proposed, there remains a notable absence of a comprehensive knowledge graph (KG) capable of systematically characterizing Android malware families. Existing approaches are predominantly confined to single-label classification paradigms, consequently failing to identify all associated family labels in multi-family malware specimens. To bridge this gap, we propose a knowledge graph-based multi-classification framework for Android malware families. Our principal contributions encompass: (1) A semi-automated pipeline for curating a reliable and temporally relevant malware dataset, culminating in the Malscope repository containing 4,247 malware samples spanning 116 distinct families; (2) An automated feature extraction engine capable of systematically retrieving thirteen static characteristics from APK files; (3) The construction of an Android malware family KG comprising 22 distinct families, 3,524 annotated samples, 308,904 semantic nodes, and 1,110,898 relational edges; (4) The development of two multi-label classification frameworks employing machine learning algorithms, achieving a classification accuracy exceeding 90% with the ML-KNN algorithm on an independent test set of 5,000 samples. Experimental results validate the efficacy of our knowledge graph-based multi-classification framework in accurately identifying and categorizing Android malware exhibiting multi-label family characteristics.

错误：搜索内容不能为空，请输入英文关键词
错误：关键词超出字数限制，请精简
高级检索

KG-AndroidDefender: Knowledge Graph Embedding for Explainable Malware Family Classification

  • 会议论文

  • 发表日期：

    2026年

查看全文
  • Chen Yi,
  • Junping Zhou,
  • Fangbing Yue,
  • Guoai Xu

摘要

The ongoing evolution of Android malware has witnessed malicious applications transitioning from single-purpose to multifaceted attack vectors, posing significant threats to user privacy and device security. While numerous classification methodologies have been proposed, there remains a notable absence of a comprehensive knowledge graph (KG) capable of systematically characterizing Android malware families. Existing approaches are predominantly confined to single-label classification paradigms, consequently failing to identify all associated family labels in multi-family malware specimens. To bridge this gap, we propose a knowledge graph-based multi-classification framework for Android malware families. Our principal contributions encompass: (1) A semi-automated pipeline for curating a reliable and temporally relevant malware dataset, culminating in the Malscope repository containing 4,247 malware samples spanning 116 distinct families; (2) An automated feature extraction engine capable of systematically retrieving thirteen static characteristics from APK files; (3) The construction of an Android malware family KG comprising 22 distinct families, 3,524 annotated samples, 308,904 semantic nodes, and 1,110,898 relational edges; (4) The development of two multi-label classification frameworks employing machine learning algorithms, achieving a classification accuracy exceeding 90% with the ML-KNN algorithm on an independent test set of 5,000 samples. Experimental results validate the efficacy of our knowledge graph-based multi-classification framework in accurately identifying and categorizing Android malware exhibiting multi-label family characteristics.