# Android Malware Detection Based on Hypergraph Neural Networks
## 4 Methodology  
### Feature Extraction  
The most important element in graph neural network-based android malicious detection is the FCG, which describes the process call relationships between functions. There should be a clear difference between the FCGs of benign and malicious applications, as malware usually requires frequent calls to risky and sensitive interfaces. This subsection focuses on the decompilation process for android applications, the acquisition of FCGs and their form, and the feature extraction for functions.  
Function Call Graphs: A function call graph is a directed graph \(\mathcal{G}=\langle\mathcal{V},\mathcal{E}\rangle\), where \(\mathcal{V}\) is the set of vertices, and each vertex represents a function, including internal and external functions, where internal functions are functions that appear in the DEX file, generally written by the developer according to the application. On the other hand, the DEX file contains only the declaration or definition of the external function and does not contain the code to perform the specific function, and the external function contains the API functional interface from android. \(\mathcal{E}=\{(u,v)|u\to v,u,v\in\mathcal{V}\}\) is the edge set, representing the Inter-Procedural Call relationship between functions.  
Features of Functions: The FCG contains a wealth of graph structure information that will be used by GNN for passing messages between vertices. However, the resulting FCG has no vertex features; thus, the next step is to find initial features that represent the function functionality of the function. The vertex features extracted in this paper are divided into two categories: centrality features and functional features.  
Centrality features: Inspired by [29], the following centrality measures of vertices are selected as the first part of the features in this paper: PageRank, Degree Centrality, Betweenness Centrality [30], Closeness Centrality [31], Katz Centrality [32], and Harmonious Centrality [33]. Due to space limitations, detailed definitions of these centrality metrics can be obtained from the references [30; 31; 32; 33].  
Functional Features: We extracted the functional features following the methods from [34]. In order to describe more specifically the semantic function of a function, this paper considers the extraction of relevant functional features from the original code of the function in the Dex file. For internal functions (Internal Method), Androguard can parse the code block of the function to obtain the class of the OpCode corresponding to the code block.  
Each opcode has a specific 8-bit binary representation, and there are 256 possible opcodes, of which 230 are given a specific meaning, leaving the remaining undefined opcodes as a fallback. Many of these opcodes have the same functional properties, for example, invoke-direct, invoke-virtual, invoke-static, etc., all essentially invoke operations. [35] combines opcodes with the same functional properties to obtain a total of 21 opcode functional groups. For any internal function \(v\) in FCG, its functional identity can be expressed as a 21-dimensional 0-1 vector \(\mathrm{opc}(v)\):\(\mathrm{opc}(v)[i]=1\), if \(v\) contains the operand of the i-th functional group. For any external function \(u\) in FCG, since the Dex file does not contain its specific code, \(\mathrm{opc}(u)[i]=0,\forall i\).  
Then, a 226-dimensional One-Hot vector \(\mathrm{api}(u)\) is obtained for any external function \(u\), where 226 is the number of all android API packages: \(\mathrm{api}(u)[i]=1\), when the external function \(u\) matches the i-th API package using the longest prefix algorithm. Since the internal function \(v\) will not match any API package, \(\mathrm{api}(v)=0,\forall v\in\mathrm{the\ set\ of\ internal\ functions}\). In summary, for any function \(v\) in FCG, the functional identity \(\mathrm{func}(v)\) of the function is obtained as shown in Equation (7).  
\[\mathrm{func}(v)=[\mathrm{opc}(v)||\mathrm{api}(v)], \tag{7}\]  
where \(||\) indicates a concate operation.