{"type":"ScholarlyArticle","title":"Out-of-sample Node Representation Learning for Heterogeneous Graph in Real-time Android Malware Detection","authors":[{"name":"Yanfang Ye","slug":"yanfang-ye","given":"Yanfang","family":"Ye","affiliation":"Department of CDS , Case Western Reserve University , OH , USA; Department of CSEE , West Virginia University , WV , USA"},{"name":"Shifu Hou","slug":"shifu-hou","given":"Shifu","family":"Hou","affiliation":"Department of CDS , Case Western Reserve University , OH , USA; Department of CSEE , West Virginia University , WV , USA"},{"name":"Lingwei Chen","slug":"lingwei-chen","given":"Lingwei","family":"Chen","affiliation":"Department of CSEE , West Virginia University , WV , USA"},{"name":"Jingwei Lei","slug":"jingwei-lei","given":"Jingwei","family":"Lei","affiliation":"Tencent Security Lab , Tencent , Guangdong , China"},{"name":"Wenqiang Wan","slug":"wenqiang-wan","given":"Wenqiang","family":"Wan","affiliation":"Tencent Security Lab , Tencent , Guangdong , China"},{"name":"Jiabin Wang","slug":"jiabin-wang","given":"Jiabin","family":"Wang","affiliation":"Tencent Security Lab , Tencent , Guangdong , China"},{"name":"Qi Xiong","slug":"qi-xiong","given":"Qi","family":"Xiong","affiliation":"Tencent Security Lab , Tencent , Guangdong , China"},{"name":"Fudong Shao","slug":"fudong-shao","given":"Fudong","family":"Shao","affiliation":"Tencent Security Lab , Tencent , Guangdong , China"}],"abstract":"The increasingly sophisticated Android malware calls for new defensive techniques that are capable of protecting mobile users against novel threats. In this paper, we first extract the runtime Application Programming Interface (API) call sequences from Android apps, and then analyze higher-level semantic relations within the ecosystem to comprehensively characterize the apps. To model different types of entities (i.e., app, API, device, signature, affiliation) and rich relations among them, we present a structured heterogeneous graph (HG) for modeling. To efficiently classify nodes (e.g., apps) in the constructed HG, we propose the HG-Learning method to first obtain in-sample node embeddings and then learn representations of out-of-sample nodes without rerunning/adjusting HG embeddings at the first attempt. We later design a deep neural network classifier taking the learned HG representations as inputs for real-time Android malware detection. Comprehensive experiments on large-scale and real sample collections from Tencent Security Lab are performed to compare various baselines. Promising results demonstrate that our developed system AiDroid which integrates our proposed method outperforms others in real-time Android malware detection.","doi":"10.24963/ijcai.2019/576","url":"https://ijcai.org/proceedings/2019/576","pdf":"https://ijcai.org/proceedings/2019/0576.pdf","markdown":"https://ijcai.org/proceedings/2019/576.md","bibtex":"https://ijcai.org/proceedings/2019/bibtex/576","volume":{"slug":"2019","title":"Proceedings of the Twenty-Eighth International Joint Conference on Artificial Intelligence","short_title":"IJCAI 2019","url":"https://ijcai.org/proceedings/2019/","year":2019,"location":"Macao","dates":"10-16 August 2019","editors":"Sarit Kraus","isbn":"978-0-9992411-4-1","publisher":"International Joint Conferences on Artificial Intelligence Organization","doi_prefix":"10.24963/ijcai.2019"},"section":"Machine Learning M-Z","track":"Main track","number":576,"pages":{"first":4150,"last":4156},"keywords":["Multidisciplinary Topics and Applications: Security and Privacy","Machine Learning: Classification"],"videos":[],"references":[{"position":1,"raw":"[Chang et al., 2015] Shiyu Chang, Wei Han, Jiliang Tang, Guo-Jun Qi, Charu C Aggarwal, and Thomas S Huang. Heterogeneous network embedding via deep architectures. In KDD, pages 119-128. ACM, 2015.","title":"Heterogeneous network embedding via deep architectures","authors":"Shiyu Chang, Wei Han, Jiliang Tang, Guo-Jun Qi, Charu C Aggarwal, Thomas S Huang","year":"2015","venue":"KDD","doi":null,"url":null,"internal_url":null},{"position":2,"raw":"[Chen et al., 2017] Lingwei Chen, Shifu Hou, and Yanfang Ye. Securedroid: Enhancing security of machine learning- based detection against adversarial android malware at- tacks. In ACSAC, pages 362-372. ACM, 2017.","title":"Securedroid: Enhancing security of machine learningbased detection against adversarial android malware attacks","authors":"Chen","year":"2017","venue":"ACSAC","doi":null,"url":null,"internal_url":null},{"position":3,"raw":"[Chen et al., 2018] Hongxu Chen, Hongzhi Yin, Weiqing Wang, Hao Wang, Quoc Viet Hung Nguyen, and Xue Li. Pme: Projected metric embedding on heterogeneous net- works for link prediction. In KDD, 2018.","title":"Pme: Projected metric embedding on heterogeneous networks for link prediction","authors":"Chen","year":"2018","venue":"KDD","doi":null,"url":null,"internal_url":null},{"position":4,"raw":"[Dong et al., 2017] Yuxiao Dong, Nitesh V Chawla, and Ananthram Swami. metapath2vec: Scalable representa- tion learning for heterogeneous networks. In KDD, 2017.","title":"metapath2vec: Scalable representation learning for heterogeneous networks","authors":"Dong","year":"2017","venue":"KDD","doi":null,"url":null,"internal_url":null},{"position":5,"raw":"[Fan et al., 2018] Yujie Fan, Shifu Hou, Yiming Zhang, Yan- fang Ye, and Melih Abdulhayoglu. Gotcha-sly malware!: Scorpion a metagraph2vec based malware detection sys- tem. In KDD, pages 253-262, 2018.","title":"Gotcha-sly malware!: Scorpion a metagraph2vec based malware detection system","authors":"Yujie Fan, Shifu Hou, Yiming Zhang, Yanfang Ye, Melih Abdulhayoglu","year":"2018","venue":"KDD","doi":null,"url":null,"internal_url":null},{"position":6,"raw":"[Fu et al., 2017] Tao-Yang Fu, Wang-Chien Lee, and Zhen Lei. Hin2vec: Explore meta-paths in heterogeneous in- formation networks for representation learning. In CIKM, pages 1797-1806, 2017.","title":"Hin2vec: Explore meta-paths in heterogeneous information networks for representation learning","authors":"Tao-Yang Fu, Wang-Chien Lee, Zhen Lei","year":"2017","venue":"CIKM","doi":null,"url":null,"internal_url":null},{"position":7,"raw":"[Grover and Leskovec, 2016] Aditya Grover and Jure Leskovec. node2vec: Scalable feature learning for networks. In KDD, pages 855-864, 2016.","title":"Aditya Grover and Jure Leskovec. node2vec: Scalable feature learning for networks","authors":"Leskovec Grover","year":"2016","venue":"KDD","doi":null,"url":null,"internal_url":null},{"position":8,"raw":"[Hou et al., 2016] Shifu Hou, Aaron Saas, Yanfang Ye, and Lifei Chen. Droiddelver: An android malware detection system using deep belief network based on api call blocks. In WAIM, pages 54-66, 2016.","title":"Droiddelver: An android malware detection system using deep belief network based on api call blocks","authors":"Hou","year":"2016","venue":"WAIM","doi":null,"url":null,"internal_url":null},{"position":9,"raw":"[Hou et al., 2017] Shifu Hou, Yanfang Ye, Yangqiu Song, and Melih Abdulhayoglu. Hindroid: An intelligent an- droid malware detection system based on structured het- erogeneous information network. In KDD, 2017.","title":"Hindroid: An intelligent android malware detection system based on structured heterogeneous information network","authors":"Hou","year":"2017","venue":"KDD","doi":null,"url":null,"internal_url":null},{"position":10,"raw":"[Huang et al., 2018] Sheng-Jun Huang, Jia-Wei Zhao, and Zhao-Yang Liu. Cost-effective training of deep cnns with active model adaptation. In KDD, 2018.","title":"Cost-effective training of deep cnns with active model adaptation","authors":"Sheng-Jun Huang, Jia-Wei Zhao, Zhao-Yang Liu","year":"2018","venue":"KDD","doi":null,"url":null,"internal_url":null},{"position":11,"raw":"[LeCun et al., 2015] Yann LeCun, Yoshua Bengio, and Ge- offrey Hinton. Deep learning. Nature, 2015.","title":"Deep learning","authors":"Yann Lecun, Yoshua Bengio, Geoffrey Hinton","year":"2015","venue":"Nature","doi":null,"url":null,"internal_url":null},{"position":12,"raw":"[Ma et al., 2018] Jianxin Ma, Peng Cui, and Wenwu Zhu. Depthlgp: Learning embeddings of out-of-sample nodes in dynamic networks. In AAAI, 2018.","title":"Depthlgp: Learning embeddings of out-of-sample nodes in dynamic networks","authors":"Jianxin Ma, Peng Cui, Wenwu Zhu","year":"2018","venue":"AAAI","doi":null,"url":null,"internal_url":null},{"position":13,"raw":"[Mikolov et al., 2013a] Tomas Mikolov, Kai Chen, Greg Corrado, and Jeffrey Dean. Efficient estimation of word representations in vector space. In arXiv preprint arXiv:1301.3781, 2013.","title":"Efficient estimation of word representations in vector space","authors":"Mikolov","year":"2013","venue":null,"doi":null,"url":null,"internal_url":null},{"position":14,"raw":"[Mikolov et al., 2013b] Tomas Mikolov, Ilya Sutskever, Kai Chen, Greg S Corrado, and Jeff Dean. Distributed repre- sentations of words and phrases and their compositionality. In NIPS, pages 3111-3119, 2013.","title":"Distributed representations of words and phrases and their compositionality","authors":"Mikolov","year":"2013","venue":"NIPS","doi":null,"url":null,"internal_url":null},{"position":15,"raw":"[Perozzi et al., 2014] Bryan Perozzi, Rami Al-Rfou, and Steven Skiena. Deepwalk: Online learning of social rep- resentations. In KDD, pages 701-710, 2014.","title":"Deepwalk: Online learning of social representations","authors":"Bryan Perozzi, Rami Al-Rfou, Steven Skiena","year":"2014","venue":"KDD","doi":null,"url":null,"internal_url":null},{"position":16,"raw":"[Saracino et al., 2018] Andrea Saracino, Daniele Sgandurra, Gianluca Dini, and Fabio Martinelli. Madam: Effective and efficient behavior-based android malware detection and prevention. TDSC, pages 240-253, 2018.","title":"Madam: Effective and efficient behavior-based android malware detection and prevention","authors":"Andrea Saracino, Daniele Sgandurra, Gianluca Dini, Fabio Martinelli","year":"2018","venue":"TDSC","doi":null,"url":null,"internal_url":null},{"position":17,"raw":"[Statcounter, 2018] Statcounter. Mobile operating system market share worldwide. In http://gs.statcounter.com/os- market-share /mobile/worldwide, 2018.","title":"Statcounter. Mobile operating system market share worldwide","authors":null,"year":"2018","venue":null,"doi":null,"url":"http://gs.statcounter.com/os-market-share/mobile/worldwide,2018","internal_url":null},{"position":18,"raw":"[Sun and Han, 2012] Yizhou Sun and Jiawei Han. Min- ing heterogeneous information networks: principles and methodologies. Synthesis Lectures on Data Mining and Knowledge Discovery, 2012.","title":"Mining heterogeneous information networks: principles and methodologies","authors":"Han ; Sun, Yizhou Sun, Jiawei Han","year":"2012","venue":"Synthesis Lectures on Data Mining and Knowledge Discovery","doi":null,"url":null,"internal_url":null},{"position":19,"raw":"[Sutskever et al., 2014] Ilya Sutskever, Oriol Vinyals, and Quoc V Le. Sequence to sequence learning with neural networks. In NIPS, pages 3104-3112, 2014.","title":"Quoc V Le. Sequence to sequence learning with neural networks","authors":"Sutskever","year":"2014","venue":"NIPS","doi":null,"url":null,"internal_url":null},{"position":20,"raw":"[Szegedy et al., 2015] Christian Szegedy, Wei Liu, Yangqing Jia, Pierre Sermanet, Scott Reed, Dragomir Anguelov, Dumitru Erhan, Vincent Vanhoucke, and Andrew Rabi- novich. Going deeper with convolutions. In CVPR, 2015.","title":"Going deeper with convolutions","authors":"Christian Szegedy, Wei Liu, Yangqing Jia, Pierre Sermanet, Scott Reed, Dragomir Anguelov, Dumitru Erhan, Vincent Vanhoucke, Andrew Rabinovich","year":"2015","venue":"CVPR","doi":null,"url":null,"internal_url":null},{"position":21,"raw":"[Tang et al., 2015] Jian Tang, Meng Qu, Mingzhe Wang, Ming Zhang, Jun Yan, and Qiaozhu Mei. Line: Large- scale information network embedding. In WWW, 2015.","title":"Line: Largescale information network embedding","authors":"Jian Tang, Meng Qu, Mingzhe Wang, Ming Zhang, Jun Yan, Qiaozhu Mei","year":"2015","venue":"WWW","doi":null,"url":null,"internal_url":null},{"position":22,"raw":"[TencentSecurity, 2018] TencentSecurity. Mobile phone se- curity report for the first half of 2018. In https://m.qq.com /security lab/news detail 471.html, 2018.","title":"TencentSecurity. Mobile phone security report for the first half of 2018","authors":"Tencentsecurity","year":"2018","venue":null,"doi":null,"url":"https://m.qq.com/securitylab/newsdetail471.html","internal_url":null},{"position":23,"raw":"[Wu and Hung, 2014] Wen-Chieh Wu and Shih-Hao Hung. Droiddolphin: A dynamic android malware detection framework using big data and machine learning. In RACS, 2014.","title":"Droiddolphin: A dynamic android malware detection framework using big data and machine learning","authors":"Wen-Chieh Wu, Shih-Hao Hung","year":"2014","venue":"RACS","doi":null,"url":null,"internal_url":null},{"position":24,"raw":"[Wu et al., 2012] D. J. Wu, C. H. Mao, T. E. Wei, H. M. Lee, and K. P. Wu. Droidmat: Android malware detec- tion through manifest and api calls tracing. In Asia JCIS, pages 62-69, Aug 2012.","title":"Droidmat: Android malware detection through manifest and api calls tracing","authors":"D J Wu, C H Mao, T E Wei, H M Lee, K P Wu","year":"2012","venue":"Asia JCIS","doi":null,"url":null,"internal_url":null},{"position":25,"raw":"[Ye et al., 2010] Yanfang Ye, Tao Li, Qingshan Jiang, and Youyu Wang. Cimds: adapting postprocessing techniques of associative classification for malware detection. TSMC, 40(3):298-307, 2010.","title":"Cimds: adapting postprocessing techniques of associative classification for malware detection","authors":"Ye","year":"2010","venue":"TSMC","doi":null,"url":null,"internal_url":null},{"position":26,"raw":"[Ye et al., 2011] Yanfang Ye, Tao Li, Shenghuo Zhu, Wei- wei Zhuang, Egemen Tas, Umesh Gupta, and Melih Ab- dulhayoglu. Combining file content and file relations for cloud based malware detection. In KDD, 2011.","title":"Combining file content and file relations for cloud based malware detection","authors":"Ye","year":"2011","venue":"KDD","doi":null,"url":null,"internal_url":null},{"position":27,"raw":"[Ye et al., 2017] Yanfang Ye, Tao Li, Donald Adjeroh, and S Sitharama Iyengar. A survey on malware detection using data mining techniques. CSUR, 50(3):40, 2017.","title":"A survey on malware detection using data mining techniques","authors":"Ye","year":"2017","venue":"CSUR","doi":null,"url":null,"internal_url":null},{"position":28,"raw":"[Ye et al., 2018] Yanfang Ye, Shifu Hou, Lingwei Chen, Xin Li, Liang Zhao, Shouhuai Xu, Jiabin Wang, and Qi Xiong. Icsd: An automatic system for insecure code snippet de- tection in stack overflow over heterogeneous information network. In ACSAC, pages 542-552, 2018.","title":"Icsd: An automatic system for insecure code snippet detection in stack overflow over heterogeneous information network","authors":"Ye","year":"2018","venue":"ACSAC","doi":null,"url":null,"internal_url":null},{"position":29,"raw":"[Zhao et al., 2018] Danling Zhao, Jichao Li, Yuejin Tan, Kewei Yang, Bingfeng Ge, and Yajie Dou. Optimization adjustment of human resources based on dynamic hetero- geneous network. Physica A, 2018.","title":"Optimization adjustment of human resources based on dynamic heterogeneous network","authors":"Zhao","year":"2018","venue":"Physica A","doi":null,"url":null,"internal_url":null},{"position":30,"raw":"[Zhu and Ghahramani, 2002] X. Zhu and Z. Ghahramani. Learning from labeled and unlabeled data with label prop- agation. CMU Technical report, 2002.","title":"Learning from labeled and unlabeled data with label propagation","authors":"Ghahramani Zhu, X Zhu, Z Ghahramani","year":"2002","venue":null,"doi":null,"url":null,"internal_url":null}],"license_note":"Copyright International Joint Conferences on Artificial Intelligence."}