Heterogeneous graph convolutional network-based Android malware detection model

With the widespread adoption of the Android operating system in the smartphone market, the prevalence of malware has also increased significantly. To accurately detect such malware, numerous existing studies have adopted machine learning and deep learning methods, where feature extraction is often based on APK files to generate fixed-size feature vectors, with common features including permissions, intents, etc. Recently, Graph Convolutional Network (GCN)-based methods have been widely applied to Function Call Graphs (FCG) extracted from APK files, showing significant potential in malware detection. However, single-node type FCGs are insufficient to fully represent APK behavioral characteristics. Therefore, this paper proposes an improved graph node classification scheme, categorizing nodes in the graph as API nodes, user nodes, and permission nodes to construct a heterogeneous graph, thus more comprehensively representing APK behavior characteristics. Ultimately, with a GCN layer depth of 2, the model achieves an accuracy of 95.59%, verifying the feasibility of the proposed method