## 1 Introduction  
Android has the highest market share of 70.26% in 2023 among the various mobile operating systems available on the market [1]. While attracting widespread attention, its open-source nature and popularity also make it a target of mobile malware. Statistical data indicate the interception of 6301 new instances of Android malware every day, signifying the detection of over four novel Android malware specimens per minute [2]. In addition, while Google proposes a permission mechanism, attackers can still engage in malicious behavior without obtaining permission [3]. To protect users' privacy, there is an urgent need for a user-friendly detection method that is effective enough to identify Android malware. While traditional Android malware detection methods primarily rely on signature-based approaches and heuristic analysis, the methods incorporating neural networks (NNs) surpass conventional models and can be divided into static analysis, dynamic analysis, and hybrid analysis methods that mix the above two methods [4]. Both of the latter two methods need program execution, which raises concerns about the computational cost and the risks of sandbox escape [5]. In contrast, static analysis, which examines code without execution, circumvents the drawbacks of dynamic analysis and attracts abundant studies to explore its potential. Researchers leverage techniques such as code analysis, permission mapping, and behavior modeling to uncover malicious patterns within Android applications. However, these detection methods usually use only one or a few static features, such as permission [6, 7, 8], frequency of API (i.e., Application Programming Interface) [9, 10], and opcode sequence [11, 12]. They are not designed to detect malwarebased on interactions between these features; therefore, it is relatively easy to evade these models using techniques of code obfuscation, such as the substitution of semantically equivalent commands for the original ones. As highlighted by [13], a graph neural network (GNN) is a specialized NN architecture adept at leveraging the inherent structural information of graphs. For example, each node in the graph in a graph convolutional network (GCN) [14] updates its embedding until the final balance due to the influence of neighbors and further nodes via a Laplace matrix. The closer the relationship between the neighbors, the greater the influence. This ability to adjust node embedding according to connected nodes is proof of exploiting graph topology to improve node classification of GNN. Further, similar to the principles elucidated in the works of [PERSON] et al. [15] and [PERSON] et al. [16], we recognize the intrinsic heterogeneity of our data in the domain of Android malware detection, which drives us to employ the capability of the heterogeneous graph to improve the performance of our model. The introduced semantics in this paper can be illustrated briefly in Figure 1, depicting the process of identifying Android malware using three distinct models. The detection method based on general NNs treats the components of applications as a group of features of the same type. In contrast, the homogeneous GNN-based method not only regards these components as a group of features but also incorporates the network structure. Addressing the limitations of both, the heterogeneous GNN-based method effectively manages applications with multi-type features and the associated network structure. By encoding these relationships within the graph, we aim to enhance the discriminative power of our malware detection model, enabling it to identify subtle patterns and abnormal behaviors indicative of malicious software. Specifically, considering the large number of entities involved in an Android application, we only combine the crucial entities into our graph. In this paper, we present an Android malware detection system, named HertDroid, based on a heterogeneous graph with a crucial node filter and a customized Android Transformer.