# Android Malware Detection Based on Hypergraph Neural Networks
## 6 Conclusions and Future Work  
In this paper, hypergraph convolutional neural networks are introduced to android malicious detection. First, this study extracts function centrality features and function functionality features using FCGs and function code blocks of android applications, respectively. Then, this study proposes two types of hyper-edge constructions: K-order common call hyperedges and common permission hyperedges. In the third part, this study establishes the overall task flow of hypergraph classification and designs the reconstruction method \begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Methods** & **Category** & **Accuracy** & **Precision** & **Recall** & **F1-Score** \\ \hline GCN & Graph-Based & 93.8 & 93.0 & 92.8 & 0.9289 \\ GIN & Graph-Based & 96.7 & 95.1 & 96.1 & 0.9559 \\ GraphSAGE & Graph-Based & 96.5 & 96.5 & 96.3 & 0.9639 \\ \hline HyperGCN & Hypergraph-Based & 93.1 & 92.8 & 92.3 & 0.9254 \\ UniGNN & Hypergraph-Based & 96.2 & 96.7 & 95.3 & 0.9599 \\ HGNNP & Hypergraph-Based & 97.1 & 96.9 & 95.2 & 0.9604 \\ HGNN & Hypergraph-Based & 97.0 & 97.2 & 96.8 & 0.9699 \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Accuracy results of Drebin. \begin{table}
\begin{tabular}{c c c} \hline \hline
**Methods** & **Category** & **Accuracy** \\ \hline Feather & Feature-Based & 86.00\% \\ NoG & Feature-Based & 77.00\% \\ LDP & Feature-Based & 86.00\% \\ Slaq-LSD & Graph-Spectral & 76.00\% \\ SLaq-VNGE & Graph-Spectral & 53.00\% \\ GCN & GNN-Based & 81.00\% \\ \hline GCN (reproduce) & GNN-Based & 75.40\% \\ GIN (reprocuce) & GNN-Based & 83.10\% \\ \hline HGNN (ours) & Hypergraph-Based & 87.60\% \\ HyperGCN (ours) & Hypergraph-Based & 79.30\% \\ UniGNN (ours) & Hypergraph-Based & 89.00\% \\ HGNNP (ours) & Hypergraph-Based & 91.10\% \\ \hline \hline \end{tabular}
\end{table} 
Table 3: Accuracy results of MalNet-Tiny. of Mini-Batch hypergraph to obtain the reconstructed hypergraph. Then, this study extracts the hypergraph embedding features through the hypergraph convolutional network and pooling layer, and finally, it uses the classifier to complete the malicious detection of android applications. In terms of experiments, this study validates the gaining effect of using hypergraphs to model android applications on two datasets, Malnet-Tiny and Drebin, and also verifies the excellent detection performance of hypergraph convolutional neural networks. The method proposed in this study has achieved good experimental results. With the expansion of research and application, further research is needed on this topic. We will conduct in-depth research mainly on the following two aspects. (1) The model should also be tested on other datasets available. Android applications have numerous features. There are also many types of malicious software, and if the data volume is not large enough, it may lead to poor model performance. (2) The current model only utilizes static analysis features, and future research can consider adding dynamic analysis features. The combination of static and dynamic features can achieve complementary advantages. Conceptualization, D.Z. and X.W. ; methodology, D.Z. ; software, E.H.; validation, H.L., X.G., and X.Y. ; formal analysis, D.Z. ; investigation, R.L. ; resources, X.W. ; data curation, X.W. ; writing--original draft preparation, D.Z. ; writing--review and editing, H.L. ; visualization, E.H.; supervision, X.Y. ; project administration, X.G. ; funding acquisition, H.L. All authors have read and agreed to the published version of the manuscript. This work is supported by Science and Technology on Communication Networks Laboratory Fund Project (FFX22641X017, FFX22641X009, HHX21641X010, HHX23641X003). Not applicable. Publicly available datasets were analyzed in this study. Two open-source datasets, Malnet-Tiny and Drebin, were used in this paper. For Drebin, please visit [[https://drebin.mlsec.org/](https://drebin.mlsec.org/)]([https://drebin.mlsec.org/](https://drebin.mlsec.org/)) (accessed on 15 October 2023).