Logo image
Back
FCGHUNTER: Towards Evaluating Robustness of Graph-Based Android Malware Detection
Journal article   Peer reviewed

FCGHUNTER: Towards Evaluating Robustness of Graph-Based Android Malware Detection

Shiwen Song, Xiaofei Xie, Ruitao Feng, Qi Guo and Sen Chen
IEEE transactions on software engineering, Vol.52(2), pp.428-448
02/2026
DOI: https://doi.org/10.1109/TSE.2025.3626788
Appears in  Recent Faculty of Science and Engineering Publications

Metrics

1 Record Views

Abstract

Android Malware Detection Codes Feature extraction Function Call Graph Malware Nearest neighbor methods Operating systems Perturbation methods Robustness Robustness Testing Semantics Testing Vectors
Graph-based detection methods leveraging Function Call Graph (FCG) have shown promise for Android malware detection (AMD) due to their semantic insights. However, the deployment of malware detectors in dynamic and hostile environments raises significant concerns about their robustness. While recent approaches evaluate the robustness of FCG-based detectors using adversarial attacks, their effectiveness is constrained by the vast perturbation space, particularly across diverse models and features. To address these challenges, we introduce FCGHUNTER, a novel robustness testing framework for FCG-based AMD systems. Specifically, FCGHUNTER employs innovative techniques to enhance exploration and exploitation within this huge search space. Initially, it identifies critical areas within the FCG related to malware behaviors to narrow down the perturbation space. We then develop a dependency-aware crossover and mutation method to enhance the validity and diversity of perturbations, generating diverse FCGs. Furthermore, FCGHUNTER leverages multi-objective feedback to select perturbed FCGs, significantly improving the search process with interpretation-based feature change feedback. Extensive evaluations across 40 scenarios demonstrate that FCGHUNTER achieves an average attack success rate of 87.9%, significantly outperforming baselines by at least 40.9%. Notably, FCGHUNTER achieves a 100% success rate on robust models (e.g., AdaBoost with MalScan), where baselines achieve less than 24% or are inapplicable.

Details

Logo image