The rapid growth in number, sophistication, and diversity of Android malware poses a great difficulty in extracting and analyzing features and behaviors. The traditional approach, which using only API calls and permissions to extract features, has no longer yielded meaningful results. | HNUE JOURNAL OF SCIENCE DOI Natural Sciences 2020 Volume 65 Issue 10 pp. 49-60 This paper is available online at http A FEATURE REPRESENTATION METHOD BASED ON HETEROGENEOUS INFORMATION NETWORK FOR ANDROID MALWARE DETECTION Thai Thi Thanh Van Nguyen Van Phac Truong Quoc Quan and Le Van Hung Faculty of Information Technology Academy of Cryptography Techniques Abstract. The rapid growth in number sophistication and diversity of Android malware poses a great difficulty in extracting and analyzing features and behaviors. The traditional approach which using only API calls and permissions to extract features has no longer yielded meaningful results. In this research we propose a method that utilizes both information about API function calls and the relationships between API functions. First we represent the relationship between API functions using a heterogeneous information network HIN . Then we use the concept of meta-path to extract information features from HIN. Finally a machine learning algorithm is used to build classification models. Experimental results on a practical dataset of Android applications show that the proposed method gives more reliable results than the existing ones. Keywords malware android heterogeneous classification machine learning. 1. Introduction Nowadays the Android operating system has become a popular platform for many smart devices because of its open-source nature and easy-to-use interface. Statistics showed that Android is still the dominating operating system of the global mobile phone market - according to IDC 2018 . This trend is still to remain until 2021. However because of this popularity Android devices have become attractive targets for malware. Hackers exploit Android application features to evade the security and privacy of the device posing an imminent threat of personal data leaks. These leaks range from user location contact information accounts photos and furthermore. The
