The proliferation of Android malware poses a substantial security threat to mobile devices. Thus, achieving efficient and accurate malware detection and malware family identification is crucial for safeguarding users’ individual property and privacy. Graph-based approaches have demonstrated remarkable detection performance in the realm of intelligent Android malware detection methods. This is attributed to the robust representation capabilities of graphs and the rich semantic information. The function call graph (FCG) is the most widely used graph in intelligent Android malware detection. However, existing FCG-based malware detection methods face challenges, such as the enormous computational and storage costs of modeling large graphs. Additionally, the ignorance of code semantics also makes them susceptible to structured attacks. In this paper, we proposed AndroAnalyzer, which embeds abstract syntax tree (AST) code semantics while focusing on sensitive behavior chains. It leverages FCGs to represent the macroscopic behavior of the application, and employs structured code semantics to represent the microscopic behavior of functions. Furthermore, we proposed the sensitive function call graph (SFCG) generation algorithm to narrow down the analysis scope to sensitive function calls, and the AST vectorization algorithm (AST2Vec) to capture structured code semantics. Experimental results demonstrate that the proposed SFCG generation algorithm noticeably reduces graph size while ensuring robust detection performance. AndroAnalyzer outperforms the baseline methods in binary and multiclass classification tasks, achieving F1-scores of 99.21% and 98.45% respectively. Moreover, AndroAnalyzer (trained with samples of 2010-2018) exhibits good generalization capabilities in detecting samples of 2019-2022.

中文翻译：

---

以敏感行为链为中心的 Android 恶意软件检测与 AST 语义融合


Android 恶意软件的扩散对移动设备构成了巨大的安全威胁。因此，实现高效、准确的恶意软件检测和恶意软件家族识别对于保护用户的个人财产和隐私至关重要。基于图的方法在智能 Android 恶意软件检测方法领域表现出了卓越的检测性能。这归因于图强大的表示能力和丰富的语义信息。函数调用图（FCG）是智能Android恶意软件检测中使用最广泛的图。然而，现有的基于 FCG 的恶意软件检测方法面临着挑战，例如建模大图的巨大计算和存储成本。此外，对代码语义的无知也使它们容易受到结构化攻击。在本文中，我们提出了 AndroAnalyzer，它嵌入抽象语法树（AST）代码语义，同时关注敏感行为链。它利用 FCG 来表示应用程序的宏观行为，并采用结构化代码语义来表示函数的微观行为。此外，我们提出了敏感函数调用图（SFCG）生成算法来将分析范围缩小到敏感函数调用，并提出了 AST 向量化算法（AST2Vec）来捕获结构化代码语义。实验结果表明，所提出的 SFCG 生成算法显着减小了图大小，同时确保了鲁棒的检测性能。 AndroAnalyzer 在二元分类和多类分类任务中优于基线方法，F1 分数分别为 99.21% 和 98.45%。 此外，AndroAnalyzer（使用2010-2018年的样本进行训练）在检测2019-2022年的样本时表现出良好的泛化能力。