AiDroid: When Heterogeneous Information Network Marries Deep Neural
  Network for Real-time Android Malware Detection
  The explosive growth and increasing sophistication of Android malware call
for new defensive techniques that are capable of protecting mobile users
against novel threats. In this paper, we first extract the runtime Application
Programming Interface (API) call sequences from Android apps, and then analyze
higher-level semantic relations within the ecosystem to comprehensively
characterize the apps. To model different types of entities (i.e., app, API,
IMEI, signature, affiliation) and the rich semantic relations among them, we
then construct a structural heterogeneous information network (HIN) and present
meta-path based approach to depict the relatedness over apps. To efficiently
classify nodes (e.g., apps) in the constructed HIN, we propose the HinLearning
method to first obtain in-sample node embeddings and then learn representations
of out-of-sample nodes without rerunning/adjusting HIN embeddings at the first
attempt. Afterwards, we design a deep neural network (DNN) classifier taking
the learned HIN representations as inputs for Android malware detection. A
comprehensive experimental study on the large-scale real sample collections
from Tencent Security Lab is performed to compare various baselines. Promising
experimental results demonstrate that our developed system AiDroid which
integrates our proposed method outperforms others in real-time Android malware
detection. AiDroid has already been incorporated into Tencent Mobile Security
product that serves millions of users worldwide.
