  With the growth of mobile devices and applications, the number of malicious
software, or malware, is rapidly increasing in recent years, which calls for
the development of advanced and effective malware detection approaches.
Traditional methods such as signature-based ones cannot defend users from an
increasing number of new types of malware or rapid malware behavior changes. In
this paper, we propose a new Android malware detection approach based on deep
learning and static analysis. Instead of using Application Programming
Interfaces (APIs) only, we further analyze the source code of Android
applications and create their higher-level graphical semantics, which makes it
harder for attackers to evade detection. In particular, we use a call graph
from method invocations in an Android application to represent the application,
and further analyze method attributes to form a structured Program
Representation Graph (PRG) with node attributes. Then, we use a graph
convolutional network (GCN) to yield a graph representation of the application
by embedding the entire graph into a dense vector, and classify whether it is a
malware or not. To efficiently train such a graph convolutional network, we
propose a batch training scheme that allows multiple heterogeneous graphs to be
input as a batch. To the best of our knowledge, this is the first work to use
graph representation learning for malware detection. We conduct extensive
experiments from real-world sample collections and demonstrate that our
developed system outperforms multiple other existing malware detection
techniques.
