Graph-Based Learning for Android Authorship Attribution: A Comparative Analysis of GNN Models

Code authorship attribution is an important research area for uncovering the source, affiliation, and purpose of software and malware. It encompasses a wide range of techniques for identifying code authorship based on the analysis of authors’ coding styles. These approaches play a critical role not only in combating copyright infringement and software piracy but also in the field of malware analysis and cybersecurity defense. Traditional code authorship attribution techniques mainly focus on semantic and lexical features while overlooking structural features. In contrast, graph neural networks (GNNs) can effectively learn from graph-structured data, enabling the incorporation of structural information into the learning process. This study investigates the authorship attribution of Android applications using GNN-based algorithms with graph representations that allow code to be expressed in terms of lexical, syntactic, structural, and semantic features. Experimental evaluations were conducted using four GNN models across the Genome and malware datasets, alongside a broader set of conventional machine learning baselines, including Random Forest, Support Vector Machine (SVM), Logistic Regression, and XGBoost. With 10-fold stratified cross-validation, Logistic Regression using graph-level features only achieved the highest mean accuracy of 97.47% on the Genome dataset and Random Forest using graph-level features only achieved the highest mean accuracy of 93.44% on the malware dataset. Among the GNN models, GraphSAGE achieved the most consistent performance across both datasets, with accuracies of 97.26% and 90.67% on the Genome and malware datasets, respectively. These findings demonstrate that GNN-based approaches can provide competitive performance for Android authorship attribution.