# Android Malware Detection Based on Hypergraph Neural Networks
###### Abstract  
Android has been the most widely used operating system for mobile phones over the past few years. Malicious attacks against android are a major privacy and security concern. Malware detection techniques for android applications are therefore significant. A class of methods using Function Call Graphs (FCGs) for android malware detection has shown great potential. The relationships between functions are limited to simple binary relationships (i.e., graphs) in these methods. However, one function often calls several other functions to produce specific effects in android applications, which cannot be captured with FCGs. In this paper, we propose to formalize android malware detection as a hypergraph-level classification task. A hypergraph is a topology capable of portraying complex relationships between multiple vertices, which can better characterize the functional behavior of android applications. We model android applications using hypergraphs and extract the embedded features of android applications using hypergraph neural networks to represent the functional behavior of android applications. Hypergraph neural networks can encode high-order data correlation in a hypergraph structure for data representation learning. In experiments, we validate the gaining effect of hypergraphs on detection performance across two open-source android application datasets. Especially, HGNN obtains the best classification performance of 91.10% on the Malnet-Tiny dataset and 97.1% on the Drebin dataset, which outperforms all baseline methods. m _arxiv 1 (2020)_2020 2020  
applications. A number of malware detection methods based on graph neural networks have emerged. Some studies use graph neural networks to extract graph embedding features of android applications from FCGs, combined with downstream classifiers for malware detection [11; 12; 13]. Compared to these studies, other studies directly combine the FCG and the extracted function features with the graph neural network. The FCG with features is provided to a graph convolutional neural network for representation learning [14; 15]. However, considering only the caller-callee relationship between functions is still insufficient to exploit the rich semantic information between functions, and this paper uses hypergraphs to construct the multiple forms of topological relationships in android applications. Inspired by the construction of hypergraphs in hypergraph neural networks, this paper proposes two ways for constructing hypergraphs: (1) considering the K-order call neighbors of the current function as a hyperedge and (2) considering functions that share the same permission as a hyperedge. In the following paper, we first introduce FCGs and methods for extracting function features. Then, we provide a feasible solution for constructing hyperedges. Finally, we establish a task flow for android malware detection based on a hypergraph-level classification. In summary, the contributions of this paper are as follows:  
1. This paper proposes for the first time the use of hypergraphs instead of graphs to model higher-order relations among functions of android applications. We propose two ways of constructing hyperedges, common call hyperedges and common permission hyperedges, and use hypergraph convolutional neural networks to extract higher-order semantic information from the constructed hypergraph. 2. This paper abstracts android malware detection as a hypergraph graph-level classification task and builds a framework for the hypergraph-level classification task. The gaining effect brought by hypergraph and hypergraph convolutional neural networks is verified with two open-source datasets. Especially, HGNNP obtains the best classification performance of 91.10% on the Malnet-Tiny dataset and 97.1% on the Drebin dataset, which outperforms all baseline methods.