# Android Malware Detection Based on Hypergraph Neural Networks
## 3 Hypergraph Neural Networks
### Hypergraph Neural Networks  
HGNN [24] estimates the convolution kernel parameters using two-order Chebyshev polynomials based on the hypergraph Laplacian proposed by [PERSON] et al. [25], as in Equation (1):  
\[\mathsf{g}*\mathsf{x}=\sum_{\mathsf{k}=0}^{\mathsf{K}}\theta_{ \mathsf{k}}\mathrm{T}_{\mathsf{k}}\left(\widetilde{\Lambda}\right)\mathsf{x}= \theta_{0}\mathsf{x}-\theta_{1}\mathrm{D}_{\mathcal{V}}^{-1/2} \mathrm{H}\mathrm{W}\mathrm{D}_{\mathcal{E}}^{-1}\mathrm{H}^{\mathsf{T}} \mathrm{D}_{\mathcal{V}}^{-1/2}\mathsf{x}, \tag{1}\]HyperGCN [26] simplifies the hypergraph by defining a non-linear Laplacian matrix that generates only one simple edge for each hyperedge, i.e., taking the two vertices with the largest signal difference between them and generating a simple edge. Specifically, for a hyperedge \(e\), the generated simple edge \((\mathrm{v_{e}},\mathrm{u_{e}})\) is as follows:  
\[(\mathrm{v_{e}},\mathrm{u_{e}}):=\mathrm{argmax}_{\mathrm{v},\mathrm{u}\in \mathrm{e}}\Big{|}\mathrm{X_{v}}-\mathrm{X_{u}}\Big{|}. \tag{3}\]  
The initial features on vertex \(\mathrm{v}\) and vertex \(\mathrm{u}\) in Equation (3) are \(\mathrm{X_{v}}\) and \(\mathrm{X_{u}}\) respectively. This generates an adjacency matrix \(\mathrm{A_{S}}\) of a simple graph, and then, the convolution of the HyperGCN is derived, as in Equation (4):  
\[\mathrm{X_{out}}=\delta((\mathrm{I_{n}}+\mathrm{A_{S}})\mathrm{X_{in}}\Theta). \tag{4}\]  
UniGNN [27] provides an integrated framework for the representation learning of graphs and hypergraphs by taking various approaches from well-established graph neural networks and extending them to hypergraphs with minimal cost. It includes UniGCN, UniGIN, UniGAT, etc. UniGNN proposes a two-stage message-passing approach as shown in Equation (5):  
\[\mathrm{h_{e}}=\mathrm{f_{1}}\big{(}\{\mathrm{x_{j}}|\mathrm{v_{j}}\in \mathrm{e}\}\big{)}, \tag{5}\]  
where \(\mathrm{x_{i}}\) is the initial feature of the vertex \(\mathrm{v_{i}}\), \(\mathrm{h_{e}}\) represents the information aggregated to the hyperedge \(\mathrm{e}\), \(\mathrm{E}(\mathrm{v_{i}})=\{\mathrm{e}\in\mathcal{E}|\mathrm{v_{i}}\in \mathrm{e}\}\) is the set of hyperedges containing the vertex \(\mathrm{v_{i}}\), and \(\mathrm{f_{1}}\), \(\mathrm{f_{2}}\) are aggregation functions. In UniGNNs, the difference between the UniGCN, UniGIN, UniGAT, and other methods lies in the choice of the two aggregation functions [27].  
HGNNP [28] provides a convolution operator that is slightly different from HGNN. It uses a random-walk-based probability transition matrix for feature propagation:  
\[\mathrm{X_{out}}=\delta\Big{(}\mathrm{D_{\mathcal{V}}^{-1}HWD_{\mathcal{E}}^{ -1}H^{T}\mathrm{x_{in}}\Theta}\Big{)}, \tag{6}\]  
Here, we provide a mathematical comparison of four typical hypergraph neural networks. HGNN is able to learn the hidden layer representation considering the high-order data structure, which is a general framework considering complex data correlations. HyperGCN is a novel GCN for SSL on attributed hypergraphs. UniGNN is a unified framework for interpreting the message passing process in graph and hypergraph neural networks, which can generalize general GNN models into hypergraphs. HGNNP introduces a general high-order multi-modal/multi-type data correlation modeling framework to learn an optimal representation in a single hypergraph-based framework. This paper abstracts android malware detection as a hypergraph graph-level classification task and uses these four hypergraph networks to implement the classification task.