# Android Malware Detection Based on Hypergraph Neural Networks
## 2 Related Research  
Traditional android malware detection techniques fall into three main categories [16]: static analysis techniques, dynamic analysis techniques, and hybrid analysis techniques. Below are mentioned several typical traditional technologies. In static analysis techniques, [PERSON] et al. [17] uses a combination of static taint analysis and a new form of program representation to efficiently detect android applications that have certain control- and data-flow properties. [PERSON] et al. [18] presents a robust approach that generates a signature by extracting statistically improbable features to detect malicious android apps. The proposed method is effective against code obfuscation and repackaging, widely used techniques to evade AntiVirus signature and to propagate unseen variants of known malware. [PERSON] et al. [19] uses a dynamic analysis method to distinguish malware with system call sequences. Two different feature models, the frequency vector and the co-occurrence matrix, are employed to extract features from the system call sequence. Hybrid analysis method combines static analysis and dynamic analysis to observe malware from a more comprehensive perspective. [PERSON] et al. [20] proposes a two-layer method to detect malware in android APPs. The first layer is permission, intent, and component information-based static malware detection model. In the second layer, a new method CACNN, which cascades CNN and AutoEncoder, is used to detect malware through network traffic features of APPs. Usually, hybrid analysis methods have better detection and recognition performance than static and dynamic analysis, but their time, hardware, and model complexity all exceed those of static and dynamic analysis. Static methods are generally more efficient than dynamic methods but are vulnerable to obfuscation techniques, such as changing function names in code. Therefore, the FCG plays an important role in the static characterization of android applications, reflecting the contextual dependencies and semantic meaning of functions at runtime rather than just remembering the form of the malware code [4; 5; 6]. With the rise of machine learning, an increasing number of researchers are focusing on how to apply machine learning to achieve android malware detection. [PERSON] et al. [21] uses different machine learning methods, including Support Vector Machines, Random Forest, and Neural Networks, to detect malware by mining the patterns of Permissions and API Function Calls acquired and used by android apps. [PERSON] et al. [22] uses decision tree classifier and kNN classifier to achieve android malicious detection scheme based on sensitive API calls. They employ mutual information to measure the correlation between specific API calls and malware, and generate a set of sensitive API calls. MalScan [4] treats FCGs as social networks and uses centrality analysis to obtain structural features of APK samples, which are then handed over to downstream classifiers for classification. Due to the large order of magnitude of vertices in FCGs, it is difficult for traditional machine learning methods to directly exploit the structural information of FCGs. The deep graph neural network approach has shown great advantages for large-scale graph-level classification tasks and is naturally suited for android malware detection tasks based on FCGs. [PERSON] et al. [11] generated embedding features of functions (vertices) using the Continuous Bag of Words (CBOW) algorithm from natural language processing. Then, they used graph neural networks to extract graph embedding features of android applications from FCGs, combined with downstream classifiers for malware detection. [PERSON] [12] first constructed a heterogeneous graph between APKs and APIs, and then obtained the neighborhood relationships between APIs using word2 vec and clustering algorithms [13]. Then, they combined graph convolutional neural networks (GCN) to learn the representations of the APKs.