TTGNet-AMD: Android malware detection based on multi-modal feature fusion

The application of static features for Android malware detection has been extensively studied and developed. Existing methods exhibit limitations in both the completeness and discriminability of feature representation, which affects the enhancement of final classification performance. To achieve a more comprehensive representation of Android software behavior and enhance the detection accuracy, Temporal-Transformer-Graph Network for Android Malware Detection (TTGNet-AMD), a novel multimodal learning model that integrates temporal opcode sequences with structural function call graphs, is proposed for Android malware detection and malware categories classification. This method first extracts the opcode sequence and Function Call Graph (FCG) features, and then prunes and optimizes FCG using the proposed optimization algorithm. Subsequently, both the opcode sequence and the optimized FCG are input into the TTGNet to integrate the two types of features for effective Android malware detection. By utilizing TTGNet, more comprehensive static features of Android software are analyzed, thereby significantly improving the accuracy of malware detection. Finally, the validity of the model was evaluated through extensive experiments in Drebin and CICMalDroid 2020 datasets. The accuracy rate of our method for malware detection is 96.30%, with an F1-score of 94.27%. For malware classification, the accuracy rate is 95.12%, and the F1-score reaches 93.26% respectively.