# Android Malware Detection Based on Hypergraph Neural Networks
## 4 Methodology
### Hypergraph Level Classification  
In this part, we focus on building a framework for hypergraph graph classification, as shown in Figure 3. In this paper, we develop a task framework for hypergraph graph classification based on the vertex classification hypergraph open-source algorithm library DHG [28]. Two of the key components are the hypergraph graph classification data loader and the pooling layer, respectively. In graph neural networks, for the graph classification task, the adjacency matrices of the graphs in a Mini-Batch need to be diagonally spliced, and the corresponding vertex ordinal numbers are increased sequentially. The hypergraph is represented as a vertex-hyperedge adjacency matrix; thus, this paper adopts the same idea of diagonally splicing the vertex-hyperedge adjacency matrix of the hypergraph in a Mini-Batch, with the vertex and hyperedge ordinal numbers increasing sequentially.  
In practice, in order to save memory, hypergraphs are generally represented as a collection of hyperedges, and the hyperedge-vertex adjacency matrix is stored as a sparse matrix; thus, it is not necessary to perform diagonal splicing operations directly at the matrix level. To achieve this diagonal splicing operation, the vertex number in the hyperedge list of each hypergraph in the Mini-Batch is simply added to the total number of vertices in all the hypergraphs preceding it. Figure 4 shows the concatenation of Mini-Batch hypergraphs.  
Figure 2: K-order common hyperedge construction.  
For the i-th hypergraph in the Mini-Batch, \(\mathcal{H}_{\rm i}=\langle\mathcal{V}_{\rm i},\mathcal{E}_{\rm i}\rangle\), let \(\forall\epsilon_{\rm j}\in\mathcal{E}_{\rm i}\,\forall\
u_{\rm k}\in\epsilon_{ \rm j}\), and \(\hat{\
u}_{\rm i}=\
u_{\rm i}+\sum_{\rm t=1}^{\rm i-1}\lvert\mathcal{V}_{\rm i}\rvert\), then, we have \(\hat{\mathcal{H}}_{\rm i}=\langle\hat{\mathcal{V}}_{\rm i},\hat{\mathcal{E}}_{ \rm i}\rangle\). The set of vertices and the set of hyperedges of these hypergraphs are merged to obtain the following: \(\mathcal{H}_{\rm Batch}=\langle\hat{\mathcal{V}}_{\rm i}\cup\hat{\mathcal{V}} _{\rm 2}\cdots\cup\hat{\mathcal{V}}_{m},\hat{\mathcal{E}}_{\rm 1}\cup\hat{ \mathcal{E}}_{\rm 2}\cdots\cup\hat{\mathcal{E}}_{m}\rangle\). Once \(\mathcal{H}_{\rm Batch}\) is obtained, the original features of the vertices are then stacked by row, corresponding to the serial numbers of the vertices mentioned above. \(X_{\rm Batch}={\rm Stack}(X_{\rm 1},X_{\rm 2},\cdots,X_{\rm m})\). \(\mathcal{H}_{\rm Batch},X_{\rm Batch})\) is provided to the hypergraph convolution module to extract the embedding features of all vertices, and after averaging the pooling layer, the embedding features of the hypergraph are obtained.  
For the binary classification problem, the Binary Cross-Entropy Loss function is chosen as shown in Equation (8):  
\[{\rm BCELoss(x,y)}=\frac{1}{\rm m}{\sum_{i=1}^{\rm m}y_{\rm i}}{\log{\rm p(x_{i })}}+(1-y_{\rm i}){\log(1-{\rm p(x_{i})})}, \tag{8}\]  
Figure 4: Concatenation of Mini-Batch hypergraphs.  
Figure 3: Framework of hypergraph malware detection.  
where \(x_{i}\) represents a hypergraph sample, \(p(x_{i})\) is the predicted value of the classifier output, \(y_{i}=\{0,1\}\) is the true label category corresponding to \(x_{i}\), and \(m\) is the number of samples in the Mini-Batch.  
For the malware family multi-classification problem, the Multi-Class Cross-Entropy Loss function is chosen as shown in Equation (9):  
\[\mathrm{MCELoss(x,y)}=\frac{1}{m}\sum_{i=1}^{m}\sum_{j=1}^{c}y_{ji}\log p(x_{i} )_{j}, \tag{9}\]  
where \(c\) is the number of categories, and \(y_{i}\) denotes the category vector of the \(i\)-th sample, and if the category of \(y_{i}\) is \(j\), then, \(y_{ji}=1\), and \(p(x_{i})_{j}\) is the predicted value of the \(i\)-th sample belonging to the \(j\)-th sample.