FCGHunter: Towards Evaluating Robustness of Graph-Based Android Malware Detection
Extracted source text · arXiv 2504.19456
% \documentclass[lettersize,journal]{IEEEtran}
\documentclass[journal]{IEEEtran}
\usepackage{amsmath,amsfonts}
% \usepackage{algorithmic}
\usepackage{algorithm} % 算法包
\usepackage{algpseudocode} % 使用 algorithm 和 algpseudocode 组合
\usepackage{array}
\usepackage[caption=false,font=normalsize,labelfont=sf,textfont=sf]{subfig}
\usepackage{textcomp}
\usepackage{stfloats}
\usepackage{url}
\usepackage{verbatim}
\usepackage{graphicx}
\hyphenation{op-tical net-works semi-conduc-tor IEEE-Xplore}
\def\BibTeX{{\rm B\kern-.05em{\sc i\kern-.025em b}\kern-.08em
T\kern-.1667em\lower.7ex\hbox{E}\kern-.125emX}}
\usepackage{balance}
\usepackage{multirow}
\usepackage{booktabs}
% \usepackage[most]{tcolorbox}
\usepackage{newunicodechar}
\usepackage{amssymb} % For empty circle
\usepackage{pifont} % For solid and half-solid circles
\usepackage{utfsym}
\usepackage{enumerate}
\usepackage{xspace}
\usepackage{amsthm}
\usepackage{algorithm}
\usepackage{algpseudocode}
\newtheorem{definition}{Definition}
\usepackage{enumitem}
\usepackage{colortbl}
\usepackage{subcaption} % 使用 subcaption 包
\usepackage{threeparttable}
\usepackage{threeparttablex}
% \usepackage[table]{xcolor} % 载入颜色包
\usepackage{lipsum}
% \usepackage{ulem}
\usepackage{soul}
\usepackage{url}
\usepackage{hyperref}
\usepackage{tcolorbox}
% Comments
\newcommand{\feng}[1]{\textcolor{blue}{F: #1}}
\newcommand{\revise}[1]{\textcolor{red}{#1}}
\newcommand{\fei}[1]{\textcolor{cyan}{fei: #1}}
\newcommand{\cs}[1]{\textcolor{green}{#1}}
\newcommand{\ssw}[1]{\textcolor{purple}{#1}}
% \newcommand{\ssw}[1]{#1}
% Symbols
\newunicodechar{✘}{\usym{2717}}
\newunicodechar{✔}{\usym{2713}}
\newunicodechar{◐}{\usym{1F313}}
\newunicodechar{◑}{\usym{1F317}}
\newunicodechar{●}{\usym{1F311}}
\newunicodechar{◯}{\usym{1F315}}
% Tools
\newcommand{\malscan}{{MalScan}\xspace}
\newcommand{\mamadroid}{{MaMaDroid}\xspace}
\newcommand{\apigraph}{{APIGraph}\xspace}
\newcommand{\hrat}{{HRAT}\xspace} % CCS21
\newcommand{\bagammo}{{BagAmmo}\xspace}
% \newcommand{\tool}{\textsc{IntelliFCGHunter}\xspace}
\newcommand{\tool}{\textsc{FCGHunter}\xspace}
% Operators
\newcommand{\addnode}{\textit{Add Node}\xspace}
\newcommand{\addedge}{\textit{Add Edge}\xspace}
\newcommand{\rewire}{\textit{Rewire}\xspace}
\newcommand{\deletenode}{\textit{Delete Node}\xspace}
\newcommand{\addsparsenodes}{\textit{Add Sparse Nodes}\xspace}
\newcommand{\adddensenodes}{\textit{Add Dense Nodes}\xspace}
\newcommand{\addlongedges}{\textit{Add Long Edges}\xspace}
\begin{document}
\title{\tool: Towards Evaluating Robustness of Graph-Based Android Malware Detection
% via Dependency-Aware Mutation and Multi-Objective Optimization
}
\author{
Song Shiwen,
Xiaofei Xie,
Ruitao Feng,
Qi Guo,
and Sen Chen
}
\markboth{Journal of \LaTeX\ Class Files,~Vol.~18, No.~9, December~2024}%
{}
\maketitle
\begin{abstract}
% To combat the threats posed by Android malware, various Android malware detection (AMD) approaches have emerged, with graph-based methods showing particular promise due to their deeper semantic insights from Function Call Graphs (FCGs).
Graph-based detection methods leveraging Function Call Graphs (FCGs) have shown promise for Android malware detection (AMD) due to their semantic insights. However, the deployment of malware detectors in dynamic and hostile environments raises significant concerns about their robustness. While recent approaches evaluate the robustness of FCG-based detectors using adversarial attacks, their effectiveness is constrained by the vast perturbation space, particularly across diverse models and features.
To address these challenges, we introduce \tool, a novel robustness testing framework for FCG-based AMD systems. Specifically, \tool employs innovative techniques to enhance \textit{exploration} and \textit{exploitation} within this huge search space.
Initially, it identifies critical areas within the FCG related to malware behaviors to narrow down the perturbation space.
We then develop a dependency-aware crossover and mutation method to enhance the \textit{validity} and \textit{diversity} of perturbations, generating diverse FCGs.
Furthermore, \tool leverages multi-objective feedback to select perturbed FCGs, significantly improving the search process with interpretation-based feature change feedback.
Extensive evaluations across 40 scenarios demonstrate that \tool achieves an average attack success rate of 87.9\%, significantly outperforming baselines by at least 44.7\%. Notably, \tool achieves a 100\% success rate on robust models (e.g., AdaBoost with \malscan), where baselines achieve only 11\% or are inapplicable.
% We conducted extensive evaluation across 40 different scenarios, incorporating eight types of features and five model variants. The results demonstrate that \tool achieves an average attack success rate of 87.9\%, which substantially outperforms baselines by at least 44.7\%.
% Its effectiveness is particularly pronounced in testing more robust models; for instance, \tool achieves a 100\% success rate on the robust model (i.e., AdaBoost with \malscan), where baselines are either inapplicable or achieve only an 11\% success rate.
\end{abstract}
\begin{IEEEkeywords}
Android Malware Detection, Function Call Graph, Robustness Testing.
\end{IEEEkeywords}
\input{tex/1-introduction}
\input{tex/2-preliminaries}
\input{tex/3-threat_model}
\input{tex/4-challenges}
\input{tex/5-methodology}
\input{tex/6-evaluation}
\input{tex/8-limitations_and_discussion}
\input{tex/7-related_work}
\input{tex/9-conclusion}
\balance
\bibliographystyle{IEEEtran}
\bibliography{main_new}
\begin{IEEEbiography}[{\includegraphics[width=1in,height=1.25in,clip,keepaspectratio]{figure/shiwen.jpg}}]{Shiwen Song}
received the B.E. degree in software engineering from Henan University, China, in 2020, and the M.E. degree in software engineering from Nanjing University, China, in 2023. She is currently pursuing the Ph.D. degree with the school of computing and information systems, Singapore Management University, starting in 2024. Her research interests include malware detection, program analysis, and Android forensics.
\end{IEEEbiography}
\begin{IEEEbiography}[{\includegraphics[width=1in,height=1.25in,clip,keepaspectratio]{figure/xfxie.jpg}}]{Xiaofei Xie} is an Assistant Professor and Lee
Kong Chian Fellow at Singapore Management University. He obtained his Ph.D from Tianjin University
and won the CCF Outstanding Doctoral Dissertation Award (2019) in China. Previously, he was a
Wallenberg-NTU Presidential Postdoctoral Fellow at
NTU. His research mainly focuses on the quality
assurance of both traditional software and AI-enabled
software. He has published top-tier conference/journal
papers in the areas of software engineering, security
and AI, focusing on the use of AI for software testing
and the testing and security of AI systems. In particular, he has received four
ACM SIGSOFT Distinguished Paper Awards and a APSEC Best Paper Award.
\end{IEEEbiography}
\begin{IEEEbiography}[{\includegraphics[width=1in,height=1.25in,clip,keepaspectratio]{figure/rtfeng.png}}]{Ruitao Feng}
is a Lecturer at Southern Cross University, Australia. He received the Ph.D. degree from the Nanyang Technological University. His research centers on security and quality assurance in software-enabled systems, particularly AI4Sec\&SE. This encompasses learning-based intrusion/anomaly detection, malicious behavior recognition for malware, and code vulnerability detection.
\end{IEEEbiography}
\begin{IEEEbiography}[{\includegraphics[width=1in,height=1.25in,clip,keepaspectratio]{figure/gq.jpg}}]{Qi Guo} received the B.E. degree from Shanghai Jiao Tong University, China, in 2010, and the M.E. degree from Tianjin University, China. He is currently pursuing the Ph.D. degree with the college of intelligence and computing, Tianjin University, China, since 2019. His research interests include code retrieval and code completion. His papers have been published in top-tier software engineering conferences, such as ICSE.
\end{IEEEbiography}
\begin{IEEEbiography}[{\includegraphics[width=1in,height=1.25in,clip,keepaspectratio]{figure/sen_chen.jpeg}}]{Sen Chen}
(Member, IEEE) is an Associate Professor
at the College of Intelligence and Computing, Tianjin
University, China. Before that, he was a Research
Assistant Professor at Nanyang Technological University, Singapore. His research focuses on software
and system security. He got six ACM SIGSOFT
Distinguished Paper Awards. More information is
available on \href{https://sen-chen.github.io/}.
\end{IEEEbiography}
\end{document}
% \vspace{-0.15cm}
\section{Introduction}\label{introduction}
% \vspace{-0.1cm}
% In the rapidly evolving mobile technology sector, Android faces significant security challenges due to its widespread adoption~\cite{androidshare} and the high incidence of malware~\cite{androidreport}.
% %In the rapidly evolving mobile technology sector, Android faces significant security challenges due to its widespread use~\cite{androidshare} and the prevalence of malware~\cite{androidreport}.
%overview for introduction
% \feng{1. Why is robustness evaluation necessary and urgent needed in the ML-AMD field? The adversarial attack is one promising direction for this.\\
% 2. why should people focus on adversarial sample generation for robustness evaluation? Why are feature-level attacks not effective in practice? Compared to feature-level attacks, what problems could be avoided/solved by code-level attacks?\\
% 3. Existing works: (1) adv for string-based has already been solved but is not suitable for FCG; adv for FCG-based has the currently unsolved problems because of its characteristics; (2) pros and cons (limits) of adv attacks on FCG (the table 1), uncovered aspects (tech/method) are important to real-world practice.\\
% 4. Summarize the challenges (specific and technical) we want to focus on and the significance/impact once solved.}
% A variety of Android malware, such as stealing users' privacy or device resources, poses a substantial threat~\cite{chatterjee2018spyware, suarez2020eight, sun2021mind}. It has also led to the development of various detection methods over the years.
% Machine learning (ML) based methods~\cite{arp2014drebin,garcia2018lightweight,xiao2019image,yuan2020byte,wu2019malscan,onwuzurike2019mamadroid,zhang2020enhancing}, which rely on static features of apps, have become increasingly popular in Android malware detection (AMD) with promising results.
\IEEEPARstart{A}{ndroid}
malware, such as those designed to steal users' privacy or device resources, has become a major threat to mobile security~\cite{chatterjee2018spyware, suarez2020eight, sun2021mind}. This growing threat, fueled by the popularity and openness of the Android platform, has driven the development of various detection methods. In recent years, machine learning (ML)-based approaches have been widely applied in Android malware detection (AMD), demonstrating promising results by leveraging static features of applications~\cite{arp2014drebin,garcia2018lightweight,xiao2019image,yuan2020byte,wu2019malscan,onwuzurike2019mamadroid,zhang2020enhancing}.
These methods can be mainly divided into two categories, i.e., string-based detection (e.g., Drebin~\cite{arp2014drebin}), and graph-based detection (e.g., \malscan~\cite{wu2019malscan}).
Graph-based methods have emerged as a particularly promising alternative~\cite{gao2024comprehensive}, offering superior performance compared to string-based ones~\cite{wu2019malscan,zhang2020enhancing,gao2024comprehensive}.
Specifically, such methods use features extracted from the Function Call Graph (FCG) of an Android package kit (APK)'s smali code (i.e., the intermediate representation of an APK after compilation~\cite{hou2017hindroid}), which offers deep semantic insights into app behaviors and effectively identifies malicious patterns.
% In contrast, graph-based methods have emerged as a promising alternative~\cite{wu2019malscan,zhang2020enhancing,gao2024comprehensive}.
% Specifically,
% In contrast, graph-based methods have emerged as a promising alternative, leveraging features extracted from the Function Call Graph (FCG) of an Android package kit (APK)'s smali code \ssw{(i.e., the intermediate representation of an APK after compilation~\cite{hou2017hindroid})} to provide deep semantic insights into app behaviors and effectively identify malicious patterns.
% such methods use features extracted from the Function Call Graph (FCG) of an Android package kit (APK)'s smali code \ssw{(i.e., the intermediate representation of an APK after compilation~\cite{hou2017hindroid})}, which offers deep semantic insights into app behaviors and effectively identifies malicious patterns.
% However, the robustness remains a significant concern, especially when the detectors are deployed in dynamic and hostile environments~\cite{barbero2022transcending}.
% \ssw{their susceptibility to adversarial attacks raises significant concerns about their robustness~\cite{carlini2017towards,shahpasand2019adversarial,chen2019android, sriramanan2020guided, li2023black, sun2023mate}.
%大量的malware实际上是保持相同语义但是不同实现的，而对于模型来说，它确给出了benign的类别，这在实际应用中会产生巨大的安全问题。
% A significant amount of malware maintains the same semantics but has different implementations. However, models often classify such malware as benign, which poses substantial security risks in real-world applications.
%例如，仅仅微小的改动，就使得模型给出了错误的分类，这会导致巨大的安全威胁在现实世界的应用中
% For example, even minor modifications can lead to incorrect classifications by the model, resulting in significant security threats in real-world applications.
% }
% \ssw{These use features extracted from the Function Call Graph (FCG) of an APK's smali code}, which offers deep semantic insights into app behaviors and effectively identifies malicious patterns. In an FCG, nodes represent functions or abstract entities (e.g., packages or families), and edges depict call relationships. In AMD, the FCG is transformed into a feature vector via graph embedding and used as input for binary classification.
% Adversarial attacks \cite{carlini2017towards,shahpasand2019adversarial,chen2019android, sriramanan2020guided, li2023black, sun2023mate} are often used to evaluate the model robustness. The performance of ML-based models can be significantly degraded after some minor perturbations or modifications.
{
However,
ML-based applications are widely recognized for their susceptibility to robustness issues
~\cite{pei2017deepxplore,xie2019deephunter,kim2019guiding,carlini2017towards,wang2021robot}, which can lead to severe consequences, particularly in safety- and security-critical contexts like autonomous driving and malware detection.
For instance, attackers can make subtle modifications to malware, preserving its malicious intent while enabling it to evade detection.
To address this, robust testing is essential before deploying ML models in dynamic and potentially hostile environments~\cite{barbero2022transcending}. To this end, adversarial attack methods~\cite{shahpasand2019adversarial,chen2019android, sriramanan2020guided, li2023black, sun2023mate} have been developed to rigorously evaluate model robustness. These evaluations help developers identify vulnerabilities, providing insights for improving robustness, such as retraining models with adversarial samples generated during testing~\cite{chen2020explore, mani2021defending, zhou2022adversarial}.
}
There are two main kinds of attacks in graph-based AMD: \textit{feature-level attacks} and \textit{code-level attacks}.
Feature-level attacks, which directly perturb the features of an APK (i.e., the model's input), can achieve high success rates~\cite{chen2019android, wu2019malscan, sun2023mate}. However, these perturbations often do not realistically reflect APK modifications, thereby compromising the fidelity of robustness assessments.
In contrast, code-level attacks alter the APK's smali code, indirectly changing its features used for detection. These attacks, conducted directly on the APK, are more realistic but inherently more complex due to the discontinuous nature of the perturbation space.
%However, such perturbations may not always correspond to realistic app modifications, as it is challenging to map these altered features back to actual APK, implying that no real app might exhibit these features.
% However, these perturbations often do not reflect realistic APK modifications, leading to low fidelity in robustness evaluation. As a result, the generated adversarial samples are ineffective in enhancing the model's robustness.
% \ssw{
% }
% This means the generated adversarial samples cannot be used to enhance the models' robustness.
% Unlike string-based detectors (e.g., Drebin~\cite{arp2014drebin}), which use simple binary features to represent the APK, FCG-based detectors exhibit a complex, nonlinear relationship between features and code.
% In FCG-based AMD, code-level attacks modify the FCG structure according to smali code syntax rules to ensure the repackaged APK preserves functionality while appearing benign, thereby evading detection.
%In FCG-based AMD, code-level attacks modify the FCG structure based on smali code syntax rules (i.e. for ensures that the modifications preserve functionality) to evade detection but the repackaged APK that appears benign.
% This ensures that the modifications preserve functionality and allow the repackaged APK that appears benign.
% On the other hand, code-level attacks involve directly modifying an APK's code, affecting the features used for detection indirectly. These attacks are more realistic yet inherently more complex due to the discontinuous nature of the perturbation space. In FCG-based AMD methods,
% In FCG-based AMD methods, code-level adversarial attacks adjust the FCG structure based on smali code syntax rules. These modifications aim to induce misclassifications while ensuring the perturbed smali code maintains the APK's functionality, allowing the repackaged APK to appear benign.
% an code-level adversarial attack involve altering the FCG of malware in such a way that the modified FCG is misclassified, allowing it to be validly recompiled into an APK that appears benign.
%On the other hand, code-level attacks, which involve modifying the APK's smali code directly and affect the feature from code indirectly, are more realistic but inherently more complex due to the discontinuous nature of the perturbation space.
%映射关系，
% \feng{Reader may be confused by the FCG-level, need to define its relationship to code-level before using it.}
Recent studies have begun to explore code-level adversarial attacks~\cite{zhao2021structural,li2023black}. Essentially, these attacks involve modifying the smali code of an APK such that its FCG can be affected. \hrat~\cite{zhao2021structural}, the pioneering work, introduced a set of FCG-level perturbation operators that can be translated into semantically consistent code-level perturbations. Furthermore, a deep Q-network (DQN) is used to guide the perturbation generation. Meanwhile,
% \bagammo~\cite{li2023black} presents a black-box attack strategy that employs the genetic algorithm to attack against a surrogate model of the targeted classifier.
\bagammo~\cite{li2023black} employs a genetic algorithm (GA) that simulates targeted classifiers with a surrogate model and modifies the FCG by inserting non-executable code, optimizing the attack process.
Despite these advancements, their effectiveness is still limited, particularly when facing relatively robust scenarios~\cite{gao2024comprehensive} (e.g., \malscan~\cite{wu2019malscan}).
% these methods are still not very effective, particularly against robust features (e.g., Malscan~\cite{wu2019malscan}) or classifiers (e.g., Random Forest).
The primary challenge lies in the \textit{vast perturbation space} in the APK, where potential modifications to an FCG can be infinite, complicating the search for adversarial perturbations.
To effectively navigate this, a variety of perturbation operators is necessary for enhanced exploration, alongside precise feedback mechanisms for better exploitation.
However, current methods are often restricted to specific mutation types, such as only adding edges~\cite{li2023black}, or they perform multiple but simplistic perturbations~\cite{zhao2021structural}, limiting the generation of diverse FCGs. Concerning feedback mechanisms, existing approaches like \hrat~\cite{zhao2021structural} predominantly rely on gradient information, which is costly and unobtainable in non-differentiable ML classifiers like Random Forest or K-nearest neighbors (KNN). These challenges become more severe when AMDs employ diverse features and models. Additionally, we observe that current methods are mainly applied and evaluated only in limited scenarios (as depicted in Table~\ref{tab:baselinescope}) and fail to be effective in scenarios with more robust features~\cite{wu2019malscan, gao2024comprehensive} (e.g., \malscan) and popular models (e.g., Random Forest).
% Recent state-of-the-art (SOTA) studies focus on code-level adversarial attacks~\cite{zhao2021structural,li2023black}.
% \hrat~\cite{zhao2021structural}, the pioneering work in this field, introduces a set of graph-level perturbation operators and employs a deep Q-network (DQN) to guide the perturbation process. \ssw{Meanwhile, \bagammo~\cite{li2023black} employs a genetic algorithm (GA) that simulates targeted classifiers with a surrogate model and inserts non-executable code to modify the graph's structure, optimizing the attack process.}
% \ssw{
% However, we observed the two studies typically focus on limited scenarios in terms of feature or classifier selection, as summarized in Table~\ref{tab:baselinescope}.
% Specifically, the state-of-the-art FCG-based feature representation method in terms of robustness~\cite{gao2024comprehensive}, \malscan~\cite{wu2019malscan}, has not been fully considered and set as the targets in existing works.}
% % Additionally, while the K-nearest neighbors (KNN) with $k=1$ classifier has been examined, popular classifiers such as multi-layer perceptron (MLP) have been overlooked in \hrat.}\feng{We need a more convincing reason (significance of ours) for 'missing this scenario (by existing) is not acceptable.'}
% % From the feature perspective, the \malscan~\cite{wu2019malscan}, which has been demonstrated to be more robust than others~\cite{gao2024comprehensive}, has been particularly less evaluated.
% % From the model perspective, while the K-nearest neighbors (KNNs) with $k=1$ classifier is examined, popular classifiers such as ensemble-based and multi-layer perceptron (MLP) have been overlooked in \hrat.
% \ssw{This discrepancy raises questions about the generalizability of existing FCG-based evaluation methods across different types of detectors.
% Based on the above observations, we assessed the performance of existing methods in previously ignored scenarios (detailed in \S~\ref{evaluation:RQ1 effectiveness}).
% Surprisingly, our findings indicate significant underperformance not only in previously overlooked scenarios but also in conditions where high success rates were claimed, consistent with discussions in the recent study~\cite{olszewski2023get} (detailed on~\cite{ourwebsite}).
% }
%为了研究FCG-based检测器的鲁棒性，
% Despite these advancements, our evaluation in \S \ref{sec:evaluation} indicates that these methods still fall short of constituting effective attacks, particularly against robust features (e.g., \malscan~\cite{wu2019malscan}) or ensemble classifiers (e.g., Random Forest).
% \begin{table}[!t]
% \footnotesize
% \centering
% \caption{The scope of existing adversarial attack methods}
% \label{tab:baselinescope}
% \scalebox{0.65}{
% \begin{tabular}{c|c|c|c|c}
% \toprule
% \textbf{Tool} & \textbf{FCG-based} & \textbf{Deep Learning} & \textbf{Instance Learning} & \textbf{Ensemble models} \\
% & \textbf{AMD} & \textbf{MLP} & \textbf{KNN-1} \&\textbf{KNN-3} & \textbf{Random Forest} \& \textbf{AdaBoost} \\
% \midrule
% & \malscan & ◯ & ◑ & ◯ \\
% \textbf{\hrat} & \mamadroid & ◯ & ◑ & ◯ \\
% & \apigraph & ◯ & ◑ & ◯ \\
% \midrule
% & \malscan & ◯ & ◯ & ◯ \\
% \textbf{\bagammo} & \mamadroid & ● & ● & ● \\
% & \apigraph & ● & ● & ● \\
% \bottomrule
% % \vspace{1mm}
% \end{tabular}
% }
% \vskip 5pt
% % \vspace{5mm} % Adjust the space here as needed
% \textbf{Note:} Solid circles (●) for full consideration, hollow circles (◯) for no consideration, and half circles (◑) for partial consideration.
% \vspace{-0.45cm}
% \end{table}
\begin{table}[!t]
\footnotesize
\centering
\caption{The Scope of Existing Adversarial Attack Methods.}
\label{tab:baselinescope}
% \vspace{-12pt} % 调整为您需要的间距
\scalebox{0.7}{
\begin{tabular}{c|c|c|c|c|c|c}
\toprule
\textbf{Tool} & \textbf{FCG-based} & \textbf{Deep Learning} & \multicolumn{2}{c|}{\textbf{Instance Algorithm}} & \multicolumn{2}{c}{\textbf{Ensemble Models}} \\
& \textbf{AMD} & \textbf{MLP} & \textbf{KNN-1} & \textbf{KNN-3} & \textbf{Random Forest} & \textbf{AdaBoost} \\
\midrule
& \textbf{\malscan} & ◯ & ● & ◯ & ◯ & ◯ \\
\textbf{\hrat} & \textbf{\mamadroid} & ◯ & ● & ◯ & ◯ & ◯\\
& \textbf{\apigraph} & ◯ & ● & ◯ & ◯ & ◯\\
\midrule
& \textbf{\malscan} & ◯ & ◯ & ◯ & ◯ & ◯ \\
\textbf{\bagammo} & \textbf{\mamadroid} & ● & ● & ● & ● & ●\\
& \textbf{\apigraph} & ● & ● & ● & ● & ●\\
\bottomrule
\end{tabular}
}
\vskip 5pt
\textbf{Note:} (●) for full consideration and (◯) for no consideration.
%and half circles (◑) for partial consideration.
\vspace{-0.4cm}
\end{table}
% \vspace{-0.47cm}
%Inspired by these findings, this paper aims to propose a more effective method for evaluating the robustness of different FCG-based malware detectors.
%To achieve this, we begin by identifying and understanding the primary challenges:
% \ssw{Inspired by our initial findings, we first analyze the primary challenges that hinder the effective evaluation of FCG-based malware detectors. The key challenge is \textit{the vast and unbounded perturbation space created by an FCG}, which can vary in size greatly, containing numerous nodes and intricate interconnections. This variability results in many potential modifications, each presenting a unique challenge, particularly in high-granularity FCGs like \malscan, where the complexity and number of nodes increase significantly~\cite{zou2021intdroid}.}
% % These graphs vary significantly in size and structure, typically containing thousands of nodes, sometimes even tens of thousands~\cite{zou2021intdroid}, as seen in high-granularity FCGs like those used by \malscan.
% % The size of an FCG generated by an APK can vary greatly, usually encompassing numerous functions and complex interconnections between them. This problem amplify in high-granularity FCGs like those used by \malscan~\cite{zou2021intdroid}. Every potential modification point in the graph is vast and unbounded.
% % The size of an FCG generated by an APK can vary greatly, often containing numerous functions and intricate interconnections. This variability results in a multitude of potential modification points, each presenting a unique challenge. This problem is particularly pronounced in high-granularity FCGs, such as those used by MalScan~\cite{zou2021intdroid}, where the complexity and number of nodes increase significantly.
% %why ineffective?
% % \ssw{Two main problems arise from this challenge:
% % \ding{182} \textit{Low-effective exploration of perturbations:}
% % Traditional strategies for exploring perturbation locations prove inadequate.
% % For example, when the random strategies and single type of perturbation of \bagammo are applied to detectors with extensive feature dimensions like \malscan, their effectiveness significantly diminishes.
% \ssw{Two main problems arise from this challenge:
% \ding{182} \textit{Low-effective exploration of perturbations:}
% For example, random strategies based on a single type of perturbation (cite bagammo) can hardly reveal the vulnerabilities in detectors with extensive feature dimensions (e.g., \malscan).
% Additionally, gradient information from FCGs suffers from biases due to the binary nature \feng{sensitivity to changes?} of the adjacency matrix values (cite HRAT) and leads to negative chain reactions while estimating the best perturbation place.
% % For example, the effectiveness of \bagammo, which employs random strategies and a single type of perturbation, significantly diminishes when applied to detectors with extensive feature dimensions (e.g., \malscan).
% % Additionally, \hrat, which models the FCG as an adjacency matrix and utilizes gradient information to estimate the best perturbation place, suffers from biases due to the binary nature of the matrix values.bl
% \ding{183} \textit{Coarse-grained evaluation of perturbation effects}:
% Using a linear surrogate model to standardize outputs from various models (cite bagammo), whether binary or continuous, often struggles to capture subtle, feature-level effects of critical perturbations, leading to local optima. Additionally, applying gradient descent for detailed model feedback (cite hrat) is ineffective for non-differentiable models (Random Forest).
% \bagammo uses a linear surrogate model to standardize outputs from various models, which can be either binary or continuous.
% However, this simplified feedback from models struggles to capture the subtle, feature-level effects of critical perturbations, easily resulting in local optima.
% Moreover, \hrat's use of gradient descent for detailed model feedback is ineffective for non-differentiable models (e.g., Random Forest).
% }
%1.原始模型的feedback，度量不同.不同的模型有不同类型的反馈，即二进制或置信度
%2.subsitute model难以捕捉到细微的变化，bagammo
%3.gradient可以捕捉到这些细微的变化，但是对于不可微分的模型并不适用。hrat
% Different types of scores from models, such as binary or continuous, are used to evaluate perturbation effects.
% To unify this, \bagammo employs a linear surrogate model with 0-1 confidence scale to represent various types of models.
% \bagammo uses a linear surrogate model to standardize scores from various models (either binary or continuous) into a unified continuous confidence.
% \bagammo uses a linear surrogate model to standardize outputs from various models, which can be either binary or continuous.
% However, this simplified feedback from models struggles to capture the subtle, feature-level effects of critical perturbations, easily resulting in local optima.
% Moreover, \hrat's use of gradient descent for detailed model feedback is ineffective for non-differentiable models (e.g., Random Forest).}
% Although scores from the model can be used to evaluate the perturbation effects, this kind of feedback varies significantly across different models, including binary and continuous scores.
% Scores from the model can be used to evaluate the perturbation effects, different models has different types of score.
% \bagammo employs a linear model to standardize outputs from different models, converting them into a unified 0-1 confidence scale.
% Although scores from the model can be used to evaluate the perturbation effects, this kind of feedback varies significantly across different models, including binary and continuous scores.
% \bagammo uses a linear model to standardize scores from different models (whatever binary or continuous scores), converting them to a unified 0-1 confidence scale.
% \bagammo attempts to standardize these using a linear substitute model, which outputs a 0-1 confidence.
% \bagammo uses a linear model to standardize scores from different models, converting them to a unified 0-1 confidence scale.
% However, such a model struggles to capture the subtle, feature-level effects of critical perturbations.
% Additionally, while \hrat utilizes gradient descent to provide detailed feedback, this approach proves ineffective with non-differentiable models (e.g., Random Forest).}
% This problem is in the FCG of varying abstraction levels, generally with thousands of nodes, which is particularly pronounced in function-granularity FCG of \malscan.
% The size of an FCG generated by an APK can vary greatly, usually encompassing numerous functions and complex interconnections between them.
% This challenge may result in two problem:
% 1. tranditional strategy in identifing perturbation place is low effective.
% when random strategies of \bagammo) are applied to detectors with huge feature dimensions like \malscan, its effectiveness markedly decreases. \hrat, which represents the graph as an adjacency matrix and utilizes gradient information for determining perturbation place, suffers from biases due to the binary nature of the matrix entries.
% 2. hard to distinguish these perturbation, how effect during the optimization? The optimization process is hindered by a lack of precise and directional feedback, making it challenging to ascertain if the algorithm is progressing as intended. While \bagammo relies on model probabilities for feedback, this method provides only coarse-grained information that fails to capture subtle but critical feature-level perturbations.
% Furthermore, \hrat utilizes gradient descent for fine-grained feedback, but this method cannot be applied to models that are non-differentiable (e.g., Random Forest).
%扰动空间，应该是fcg的，我们不做feature level的attack
%vast perturbation space will result in:
%1.hard to identify perturbation:
%2.hard to distinguish many perturbation, which one more effective:
% The primary challenges include:
%1, Vast perturbation space
%2. Miss effective feedback
% \ssw{
% \ding{182}
% \textit{Vast Perturbation Space}:
%每一个APK所创造的FCG的大小是不同的，通常一个APK会有多少个function？然后对于每一个function和edge在图中的关系是什么样的？那么每次修改的位置和类型都是无限的。
%对于bagammo来说，它采用随机的策略来选择，那么，对于它的paper中选择了feature维度较小的mamadroid和apigraph，效果还不错，当我们将它扩展到malscan这种feature维度巨大的detector上的时候，他的有效性瞬间降低。对于hrat来说，它将graph表示成邻接矩阵，然后计算该矩阵的梯度信息来估计修改位置，然而这种估计是存在偏差的，由于矩阵中的值是binary的，而不是微小的变化。
% The size of an FCG generated by an APK can vary greatly, usually encompassing numerous functions and complex interconnections between them. Every potential modification point in the graph is vast and unbounded. Therefore, when random strategies of \bagammo) are applied to detectors with huge feature dimensions like \malscan, its effectiveness markedly decreases. \hrat, which represents the graph as an adjacency matrix and utilizes gradient information for determining perturbation place, suffers from biases due to the binary nature of the matrix entries.
% \ding{183} \textit{Lack of Precise Feedback}:
%在优化过程中，如果没有有方向性的feedback，难以确定算法是否按照预想的方向前进。对于bagammo来说，他们都选择了来自模型的probilities作为feedback，这是一种非常粗粒度的信息，难以区分feature级别的变化，因为不同的扰动序列可能产生相同的probilities，但是这些扰动序列可能只有少数是可以继续优化绕过检测器的。
% The optimization process is hindered by a lack of precise and directional feedback, making it challenging to ascertain if the algorithm is progressing as intended. While \bagammo relies on model probabilities for feedback, this method provides only coarse-grained information that fails to capture subtle but critical feature-level perturbations.
% Furthermore, \hrat utilizes gradient descent for fine-grained feedback, but this method cannot be applied to models that are non-differentiable (e.g., Random Forest).
% }
%\ding{182} \textit{Diversity of Perturbations}: The effectiveness of adversarial attacks heavily depends on the diversity of the perturbations, which determines the possible inputs generated. Current approaches are limited to adding only certain types of mutations (e.g., only adding edges~\cite{li2023black}) or performing multiple types of perturbations but with limited combinations (e.g., only performing a type of perturbation at each attack trial). This restricts their ability to generate sufficiently diverse FCGs to evaluate the detection systems.
%\ding{182} \textit{Vast Perturbation Space}: The potential modifications in an FCG can be infinite, creating an enormous search space for generating adversarial examples. Existing methods like \hrat~\cite{zhao2021structural} depend on gradient information for efficient navigation of extensive spaces, but the gradient information is missed in non-differentiable ML classifiers (e.g., Random Forest). They do not provide effective feedback mechanisms to navigate this extensive space efficiently.
%1. low-effecient exploration
%我们使用启发式搜索
%2.
Motivated by these issues, this paper introduces \tool, a testing method specifically designed to assess the robustness of FCG-based malware classifiers across various feature types and models. \tool optimizes a sequence of perturbations to the original FCG, such that the malware can bypass detection after the modifications. Specifically, \tool tackles the exploration and exploitation challenge in the vast perturbation space through several innovative strategies: 1) it narrows the search space by pinpointing critical areas of the FCG based on sensitive system APIs; 2) it incorporates diverse perturbation operators, including three novel types (e.g., \textit{Adding Long Edges}) that significantly impact FCG features for better exploration; 3) it introduces a dependency-aware mutation representation and a conflict-resolving strategy, ensuring the feasibility of the sequence of perturbations; and 4) for optimal exploitation, \tool employs a multi-objective optimization. Except for the model output feedback, a novel interpretation-based feedback, utilizing the SHAP method~\cite{SHAP2017}, is proposed to prioritize perturbations that significantly affect crucial features, thus improving the effectiveness of the whole search.
% \ssw{
% %直观上，这是一个启发式搜索的问题。
% %结合FCG-level的搜索空间特性，我们选择利用GA的平行探索能力来实现我们的目标。
% % Conceptually, \tool addresses this as a heuristic search problem, leveraging the parallel search capabilities of GA to navigate the extensive FCG-level perturbation space effectively.
% %为了解决第一个问题，
% To mitigate the first problem, \tool pinpoints critical areas in the FCG, significantly reducing the perturbation space based on the characteristics of graph embedding methods.
% %为了更充分的探索搜索空间，
% In contrast to \bagammo that use a single operator, \tool integrates seven semantic-preserving perturbation operators (e.g., \textit{Adding Long Edges}, \textit{Rewiring}) that indirectly affect the graph's features without altering the code's semantics.
% It is designed to generate more possible combinations (i.e. the diversity) of operators in a sequence to enhance exploration in FCG generation.
% %与单一操作符不同的是，多种操作符的组合会产生冲突，
% To mitigate potential conflicts from combinations of multiple operators,
% % To mitigate potential conflicts (e.g., attempting to remove a non-existing node),
% we develop a dependency-aware representation, which maintains the dependencies among perturbations and includes a conflict-resolving strategy to ensure the validity of the perturbation sequence.
% %为了解决第二个问题，
% To deal with the second problem, we introduce a novel interpretation-based fitness function that considers both model output and the feature importance.
% %This dual approach mitigates the risk of local optima that can occur when relying solely on model output feedback.
% By employing the interpretation method (i.e., SHAP~\cite{SHAP2017}), \tool prioritizes perturbations that substantially impact key features, thereby enhancing the search effectiveness.
% }
% To address these challenges, we introduce \tool, a white-box adversarial attack technique designed to evaluate the robustness of FCG-based malware classifiers. \tool aims to optimize a sequence of perturbations on the original FCG to ensure that malware can bypass detection after these modifications.
% Addressing the first challenge \ding{182}, \tool integrates seven semantic-preserving perturbation operators (e.g., \textit{Adding edges}, \textit{Rewiring}) that indirectly affect the graph's features without altering the code's semantics.
% It is designed to generate various combinations of operators in a sequence to enhance exploration and diversity in FCG generation.
% To mitigate potential conflicts (e.g., attempting to remove a non-existing node), we develop a dependency-aware representation, which maintains the dependencies among perturbations and includes a conflict-resolving strategy to ensure the validity of the perturbation sequence.
% To tackle the second challenge \ding{183}, \tool pinpoints critical areas in the FCG, significantly reducing the perturbation space based on the characteristics of graph embedding methods.
% Furthermore, we introduce a novel interpretation-based fitness function that considers both model output and the feature importance. This dual approach mitigates the risk of local optima that can occur when relying solely on model output feedback. By employing the interpretation method (i.e., SHAP~\cite{SHAP2017}), \tool prioritizes perturbations that substantially impact key features, thereby enhancing the search effectiveness.
%与hrat的强化学习不同的是，我们利用GA的平行探索能力更充分的探索扰动空间。
% Technically, unlike the reinforcement learning used in \hrat, \tool is implemented within a GA framework due to the parallel exploration capabilities more fully explore the perturbation space.
Technically, \tool is implemented within a genetic algorithm framework.
% This allows \tool to leverage the parallel exploration capabilities of GAs to more thoroughly explore the perturbation space.
Each individual in the population is represented as a sequence of perturbations, where each gene is not just a single perturbation but a sub-sequence of dependent perturbations. These sub-sequences, containing highly interdependent perturbations, are considered together during crossover and mutation processes to ensure the validity of the generated FCG.
%Following dependency-aware crossover and mutation,
{Following this step,
individuals are selected based on interpretation-assisted fitness scores that evaluate the effectiveness of perturbations in evading detection. If conflicts arise, \tool resolves them by adjusting or removing the conflicting perturbations, ensuring that the best candidates are retained for further evolution.
%To avoid local optima, \tool reinitializes the population with the most successful FCG from the previous iteration, thus allowing for more effective adversarial FCG generation.
% \fei{We need results here}
To demonstrate the effectiveness of \tool, we conducted comprehensive experiments on 40 distinct target models, incorporating eight types of graph embeddings and five different ML classifiers. To the best of our knowledge, we are the first to evaluate AMD systems across such a broad and diverse range, covering all the scenarios outlined in Table~\ref{tab:baselinescope}.
\tool achieves an average attack success rate of 87.9\% across these detection models, significantly outperforming state-of-the-art methods (i.e., \hrat and \bagammo) by at least 44.7\%.
Our experiments also confirm the usefulness of the key components in \tool. Based on the transferability of different models, we also applied \tool to evaluate the robustness of black-box models (i.e., VirusTotal) in the real world, revealing the robustness issues of such models.
% Additionally, we also apply \tool to evaluate the robustness of real-world black-box detector and demonstrated its usefulness in practical settings.
% \feng{Didn't we remove the black-box experiments from the paper?}}
In summary, our main contributions are as follows:
\begin{itemize}[leftmargin=*]
% \vspace{-5pt}
\item We expose the challenges presented by current approaches for attacking three widely-used ML model types: deep neural networks, k-nearest neighbors, and decision trees, each trained with distinct feature sets. Our analysis reveals that existing methods have limitations in certain scenarios, particularly regarding the models and feature types.
% \item We design an innovative testing framework for evaluating the robustness of FCG-based AMD. The novelty of our approach lies in optimizing valid perturbation sequences with the multi-objective optimization.
\item {We propose a novel robustness testing framework, incorporating dependency-aware mutation and multi-objective optimization, which can effectively evaluate different kinds of graph-based Android malware detectors. Our approach generates adversarial samples while preserving the malicious functionalities of the malware, leveraging diverse perturbation operators for enhanced exploration and precise feedback mechanisms for optimal exploitation.}
% \item We found that tree-based models using \malscan are more robust than others. We specifically developed a constraint-aware testing strategy tailored for tree-based classifiers, enhancing the effectiveness.
\item We conduct comprehensive experiments across 40 target models, spanning five distinct model and eight feature sets, which demonstrate the effectiveness of \tool. We have made our dataset and code publicly available~\cite{ourcode}.
% \item \ssw{We propose a robustness testing framework (\S 4, \S 5, \S 6) based on dependency-aware mutation and multi-objective optimization to comprehensively evaluate graph-based Android malware detectors. This framework generates benign adversarial samples that retain malicious functionality, helping to reveal vulnerabilities in detectors.}
% \item \ssw{Our approach narrows the search space through graph preprocessing (\S 5), enhances exploration using diverse perturbation operators (\S 6.2), and optimizes perturbation sequences with precise feedback mechanisms (\S 6.4). Ultimately, we identify a set of effective perturbations that enable malware to evade detection.}
% \item \ssw{We applied this tool to test 40 advanced graph detectors (\S 7.2) and found that \malscan demonstrates higher robustness in ensemble models (i.e., Random Forest and AdaBoost). Consequently, we designed three combined mutation operators (\S 6.1) and a constraint-aware testing strategy (\S 6.4.3) tailored to ensemble models, significantly enhancing testing effectiveness.}
% \item \ssw{Compared to baselines, our approach applies to a broader range of scenarios. Our findings suggest that using ensemble models and \malscan features can improve model resilience. Additionally, we discuss how the generated adversarial samples are used to enhance model robustness (\S 8).}
% We conduct extensive experiments across 40 target models, with \tool achieving an average attack success rate of over 87.9\% across these detection models, significantly outperforming SOTA attacks (i.e., \hrat and \bagammo) by at least 47\%.
% Our experiments also confirm the usefulness of \tool's key components, overall performance, and its other applications in black-box scenarios.
%我们的实验结果在三种
% \ssw{We conduct e
% demonstrate that \tool achieves an average success rate of 87.9\% and outperforms state-of-the-art attacks by at least 47\% across 40 target models.
% We also show persistent vulnerabilities in real-world settings and demonstrate that retraining the model can improve robustness.}
% To foster transparency and facilitate further research, we have made our dataset and code publicly available~\cite{ourcode}.
% \footnote{\url{https://anonymous.4open.science/r/FCGHUNTER/}}.
\end{itemize}
% \vspace{-10pt}
\section{Graph-based Android Malware Detection}\label{preliminaries}
% \vspace{-5pt}
% \feng{Need a brief. Why should the following be selected as the targeted models? Currently necessary evaluation criteria (existing)/unsolved problems (what is new) in adv for FCG (ensure the readers' focus never gets lost).}
% In this section, we introduce essential preliminary knowledge covering graph-based feature extraction, machine learning based malware detectors, and existing FCG-based adversarial attacks.
% \vspace{-0.15cm}
% \subsection{FCG-based Android Malware Detection}
% \vspace{-0.15cm}
{
Graph-based detection leverages features extracted from the FCG of an APK's smali code (i.e., the intermediate representation of an APK after compilation~\cite{hou2017hindroid}), which captures the runtime behavior semantics of the application. The FCG is then transformed into a feature vector via graph embedding, which is subsequently used for binary classification to determine whether the application exhibits malicious behaviors. Next, we will introduce the main FCG-based methods, which include three graph embedding techniques and three widely used ML-based classifier types.
% Building on evaluations~\cite{wu2019malscan, onwuzurike2019mamadroid, gao2024comprehensive, yang2024novel} and adversarial attacks~\cite{chen2019android, zhao2021structural, li2023black, he2023efficient}, we highlight key FCG-based methods, including three graph embedding techniques and five widely used ML-based classifiers, which stand out due to their efficacy and adoption.
}
% Graph-based detection includes graph embedding and binary classification.
% In an FCG, nodes represent functions or abstract entities (e.g., packages or families), and edges depict call relationships. In AMD, the FCG is transformed into a feature vector via graph embedding and used as input for binary classification.
% Graph-based detection involves graph embedding and binary classification. First, the FCG of an APK’s smali code is created, with nodes representing functions or abstract entities (e.g., packages or families) and edges depicting call relationships. The FCG is then transformed into a feature vector via graph embedding, which is used for binary classification to determine if the app contains malicious patterns.
% }
\vspace{-10pt}
\subsection{Graph Embedding Methods}\label{preliminaries:embedding}
% \vspace{-5pt}
This step involves deriving a vector from an APK’s FCG, where nodes represent functions or abstract entities and edges depict call relationships, to capture crucial structural and behavioral patterns for classification. In the following, we will briefly introduce the three commonly used features~\cite{gao2024comprehensive}, i.e., \malscan, \mamadroid, and \apigraph.
%: \malscan, \mamadroid, and \apigraph.
\textbf{\malscan}~\cite{wu2019malscan} emphasizes the importance of 21,986 critical system API calls within function-level FCGs.
It employs four centrality metrics: \textit{Degree}, \textit{Katz}, \textit{Closeness}, and \textit{Harmonic}, each offering unique insights into a node's significance, and two combined centrality metrics: \textit{Average} and \textit{Concentrate}, to enhance the robustness of the extracted features.
% It utilizes six centrality metrics—\textit{Degree}, \textit{Katz}, \textit{Closeness}, \textit{Harmonic}, \textit{Average}, and \textit{Concentrate}—to assess and quantify the significance of these nodes, providing unique insights into each metric’s impact on feature robustness.
% utilizes function-level FCGs, emphasizing the importance of 21,986 critical API calls and employs six centrality metrics to provide unique insights into their significance.
%analyzes FCGs extracted from APK files, emphasizing the importance of nodes that represent 21,986 critical system API calls.
%It identifies and quantifies the centrality of 21,986 sensitive nodes.
%malscan利用function-level的fcg，强调了21986个关键api call的重要性，使用6种中心度方法来衡量它们的重要程度。
% It employs four centrality metrics: \textit{Degree}, \textit{Katz}, \textit{Closeness}, and \textit{Harmonic}, each offering unique insights into a node's significance, and two combined centrality metrics: \textit{Average} and \textit{Concentrate}, to enhance the robustness of the extracted features.
%mamadroid model focus on call probabilities based on a Markov chain within abstract FCGs. Due to every function-level node can be abstracted to a family or a package, it has two mode
%i.e., family-level FCGs and package-level FCG.
%So it defines 11 families and 446 families.
{\textbf{\mamadroid}~\cite{onwuzurike2019mamadroid}
employs a Markov chain, represented as a transition matrix, to model call probabilities between abstract states (e.g., family names) within function-level FCGs, effectively characterizing app behavior. Consequently, it provides two graph embedding modes: family-level with 11 states and package-level with 446 states.}
% \textbf{\mamadroid}~\cite{onwuzurike2019mamadroid} employs a Markov chain to model transition probabilities between abstract states, which are derived from family or package names within the FCG, to characterize app behavior. \mamadroid provides two modes of feature extraction based on different levels of abstraction: family-level mode with 11 distinct states and package-level mode encompassing 446 states.
%apigraph利用android api document构建了一个知识图谱，然后使用一种基于语义的聚类方法对其他graph embedding的方法进行抽象升级，这可以大大减少特征的维度。
{\textbf{\apigraph}~\cite{zhang2020enhancing} utilizes a knowledge graph built upon the official Android API documentation to group APIs with similar functionalities or usage contexts through clustering. Therefore, it not only abstracts the representation of FCGs but also significantly reduces feature dimensions. For instance, it can reduce the dimensions in \mamadroid's package mode.}
% \textbf{\apigraph}~\cite{zhang2020enhancing} uses a graph embedding approach that extracts relationships between APIs based on a comprehensive knowledge graph built upon the official Android API documentation. Through clustering, APIs with similar functionalities or being used in similar contexts will be grouped in the FCG. Therefore, it will replace individual functions with the clusters they belong to, which not only achieves a higher level of abstraction but also facilitates a significant reduction in feature dimension.
% \ssw{More explanations are available on our website~\cite{ourwebsite}.} \fei{Why we need this setence here??}
% \vspace{-0.15cm}
\vspace{-10pt}
\subsection{ML-based Classifiers}\label{preliminaries:ml_dl_methods}
% \vspace{-3pt}
% \subsubsection{ML-based Classifiers in AMD}\label{preliminaries:ml_dl_methods}
% ML-based methods have been commonly applied in AMD.
{After obtaining feature vectors via the graph embedding, ML-based methods are employed for the binary classification (i.e., malware or not).
There are three commonly used types of classifiers: deep learning (DL), instance-based learning, and ensemble-based learning.}
%i.e., MLP, KNNs with $k = 1$ and $k = 3$, and ensemble models like Random Forest and AdaBoost.
% \textbf{Multi-Layer Perceptron.}
{\textbf{Deep learning.}
Multi-Layer Perceptron (MLP) is a basic DL model widely used in AMD and adversarial attacks~\cite{yuan2019lightweight, li2021backdoor, he2023efficient,li2023black}.
MLP learns nonlinear relationships between input features and output class labels, and it outputs a continuous score from 0 to 1 that indicates the probability of a sample being malicious, using a sigmoid activation function.
% Therefore, it is susceptible to gradient-based attacks~\cite{ren2020adversarial}.
}
\textbf{Instance-based learning.}
% \textbf{KNNs.}
The KNN algorithm, a typical instance-based method commonly used in AMD~\cite{kakavand2018application, chen2019android, zhao2021structural, he2023efficient,li2023black}, classifies data points by measuring distances (typically using Euclidean~\cite{danielsson1980euclidean} metrics) to the nearest training samples.
For each query, it selects the k closest samples (e.g., $k=1$) and assigns a class based on the majority label among these neighbors.
% thus outputting discrete labels that indicate whether samples are malicious, potentially enhancing its robustness against attacks compared to MLP.}
% As a typical instance-based method, the KNN classifies data points by measuring distances (e.g., Euclidean distance~\cite{danielsson1980euclidean}) between them, which is popular in AMD~\cite{kakavand2018application, chen2019android, zhao2021structural, he2023efficient,li2023black}.
% Specifically, it uses metrics like Euclidean distance~\cite{danielsson1980euclidean} to measure the distance between a given sample and all training samples. It then selects the k (e.g., $k=1$) nearest training samples and predicts the new sample’s class based on a majority vote from these neighbors' known categories. Thus, the KNN outputs discrete labels indicating whether samples are malicious.
% The KNN algorithm, a typical instance-based method used in AMD, classifies data points by measuring distances—typically using Euclidean metrics—to the nearest training samples. For each query, KNN selects the k closest samples (e.g., \( k=1 \)) and assigns a class based on the majority label among these neighbors, thus outputting discrete labels that indicate whether samples are malicious~\cite{kakavand2018application, chen2019android, zhao2021structural, he2023efficient, li2023black, danielsson1980euclidean}.
\textbf{Ensemble-based learning.}
% \textbf{Ensemble models.}
Random Forest and AdaBoost~\cite{chen2019android, onwuzurike2019mamadroid, he2023efficient, li2023black} effectively combine multiple learning algorithms to enhance both performance and robustness.
Random Forest, an ensemble of decision trees, consolidates decisions through majority voting,
% This method ensures model stability by averaging predictions from trees trained independently,
thus mitigating the influence of any single, potentially biased model.
AdaBoost sequentially applies a series of weak learners to progressively modified datasets, thereby incrementally improving the performance of initially weak classifiers.
% Compared to MLP, although ensemble models output continuous probabilities, their decision boundaries are usually more complex.}
% The ensemble-based strategy not only boosts the model's accuracy but also enhances its robustness against adversarial attacks.
% \vspace{-0.15cm}
% \subsection{FCG-based Adversarial Attacks}\label{preliminaries:adversarial_attack}
% \vspace{-0.15cm}
% Compared to feature-level attacks, FCG-based attacks are more realistic and could preserve the functionality of the original app. We identified two SOTA methods~\cite{zhao2021structural,li2023black}, which align closely with our objectives.
% \textbf{\hrat}~\cite{zhao2021structural} is the first work that proposes a realistic FCG-based adversarial attack. It formulates four types of mutation rules to maintain semantic consistency between the original and the newly mutated FCG. To enhance the effectiveness of these mutations, \hrat employs a DQN to select the most appropriate next mutation rule strategically. Additionally, it utilizes a gradient search method to identify the target edges and nodes, thereby increasing the likelihood of generating successful adversarial FCGs.
% \textbf{\bagammo}~\cite{li2023black} introduces a black-box attack that operates using a Graph Convolutional Network (GCN) as a surrogate model. This approach employs a GA to optimize mutation operators that modify the FCG. Specifically, \bagammo focuses solely on the edge addition operator, a choice that might restrict its capacity to generate a diverse range of FCGs. To effectively guide the generation, the tool utilizes the output score from the surrogate model as a fitness measure for selecting the most promising mutations.
\vspace{-10pt}
\section{Problem Formulation}
\vspace{-0.08cm}
% \subsection{Threat Model}
% \vspace{-0.15cm}
% \textbf{Attacker's Motivation.}
% The adversary's primary goal is to perform a white-box adversarial attack on a target malware detection system so that malware can evade detection. Specifically, the adversary begins by extracting the Smali files from the malware's APK file. These files are then subjected to semantic-preserving perturbations, carefully manipulating the Smali code to avoid altering the intended functionality. Once the code is manipulated, it is recompiled to produce a new APK file designed to bypass the malware detection system.
% \textbf{Attacker's Knowledge.}
% Similar to~\cite{zhao2021structural}, our model assumes a white-box attack scenario where the adversary has complete access to the feature extraction process, model design, and corresponding parameters of the target malware detector. Following the rationale of Kerckhoffs’ principle~\cite{petitcolas2023kerckhoffs}, which argues that security should not rely on hinding, we consider this level of transparency necessary. For instance, an attacker could infer the features and models employed by the detector based on prevalent techniques introduced in the literature~\cite{gao2024comprehensive}. Additionally, the attacker could represent a `blue team' member, aiming to evaluate and enhance the robustness of a malware detection system against various model and feature configurations prior to real-world deployment.
% \vspace{-0.15cm}
% \subsection{Problem Definition}
% \vspace{-0.15cm}
%how to ensure functional equivalence
%1.only user funcion can be modify
%2.modify rules based on the former work
% \vspace{-3pt}
{Given a target AMD system represented by model \( M(\cdot) \),} which classifies input APKs as either benign or malware, {we use $G$ and $E$ to represent the functions that extract FCG from the APK and calculate the embedding of the FCG, respectively. For a given malware $m$, the problem of AMD testing is to calculate the FCG perturbations $\delta \in \Delta$ such that:}
% \vspace{-5pt}
\begin{equation}
% \vspace{-5pt}
\footnotesize
M(E(G(m))) \neq M(E(G(m)+\delta)) \wedge F(m) =F(m+reverse(\delta))
% \vspace{-3pt}
\end{equation}
% \vspace{-2pt}
where $\Delta$ represents all possible perturbations on the vast space of FCG and $F$ represents the functionalities of the APK.
% The perturbation must be reversible, allowing it to be mirrored at the code level (i.e., $m+reverse(\delta)$).
The formulation sets forth three critical requirements for calculating the perturbation: 1) the perturbation should be reversible, allowing it to be mirrored at the {smali code level} (i.e., $m+reverse(\delta)$); 2) the perturbation does not affect the functionality; and 3) the feature should be alerted sufficiently to change the final prediction outcome. Addressing this problem necessitates an effective optimization-based method to search and apply these perturbations effectively.
% The objective is to identify code-level perturbations (e.g., add a function), which do not alter the functionality but change the FCG's features in a way that affects the model's output.
% The objective is to identify code-level perturbations based on the modification rules from the previous work~\cite{zhao2021structural}, which do not alter the functionality but change the features in a way that affects the model's output.
% The objective is to identify code-level perturbations based on the modification rules from previous works~\cite{zhao2021structural, li2023black}, which do not alter the functionality but change the FCG's features in a way that affects the model's output, thereby evaluating the robustness of model.
% In the context of an FCG-based detector, we redefine the problem to identify FCG-level perturbations $\delta_{FCG} \in \Delta_{FCG}$ such that:
% \begin{equation}
% \label{eq:problem}
% \footnotesize
% M(E(F(m))) \neq M(E(F(m)+\delta_{FCG})) \wedge F(m =_{f} m+reverse(\delta_{FCG})
% \end{equation}
% Given the vast complexity of the app's code, directly perturbing it poses significant challenges. In the context of an FCG-based detector, we redefine the problem to identify FCG-level perturbations $\delta_{FCG} \in \Delta_{FCG}$ such that:
% \begin{equation}
% \label{eq:problem}
% \footnotesize
% M(E(F(m))) \neq M(E(F(m)+\delta_{FCG})) \wedge m =_{f} m+reverse(\delta_{FCG})
% \end{equation}
% \vspace{-0.15cm}
% \subsection{Our Motivation and Challenges}\label{sec:challenge}
% \vspace{-0.15cm}
% Our motivation arises from two critical observations:
% \textbf{Motivation 1}: Despite high reported success rates in existing FCG-based attack works~\cite{zhao2021structural} and~\cite{li2023black}, these studies often focus on limited scenarios in terms of classifier selection. As summarized in Table~\ref{tab:baselinescope}, which uses solid circles for full consideration, hollow circles for no consideration, and half circles for partial consideration, we observe a gap in the feature and model selection. From the feature perspective, particularly, the \malscan method, which has been demonstrated more robust than others~\cite{gao2024comprehensive}, has been less evaluated. From the model perspective, while KNN-based classifiers are examined, ensemble-based and MLP methods have been overlooked in \hrat. This discrepancy raises questions about the generalizability of existing FCG-based methods across different types of detectors, especially the robust features like \malscan.
% % \item
% \textbf{Motivation 2}: Based on the above observations, we conducted preliminary evaluations to gauge the performance of existing methods in scenarios they previously ignored, particularly when utilizing \malscan features (detailed results in \S~\ref{evaluation:RQ1 effectiveness}). Contrary to the high success rates claimed, our findings reveal significant underperformance in these unconsidered scenarios. This discrepancy in performance is also consistent with the discussion in a recent study~\cite{olszewski2023get}.
% Motivated by these motivations, this paper seeks to understand the challenges of FCG-based attacks and to develop a more effective method for evaluating the robustness of different kinds of FCG-based malware detectors.
% Based on the formula referred to in Equation~\ref{eq:problem} and observations noted in Table~\ref{tab:baselinescope}, we summarize the challenges as follows:
% \textbf{Design of the FCG-based Perturbations (C1)}: The perturbation must be both realistic and diverse. Realism is crucial as perturbations should be reversible, allowing for the realistic reproduction of malware from the perturbed FCG. Diversity in adversarial attacks is equally important, as it influences the ability to generate varied inputs for robustness evaluation. Reliance on a limited set of perturbations curtails the generation of diverse inputs, potentially compromising the effectiveness of the robustness assessment.
% \textbf{Vast Perturbation Space (C2)}: The potential changes in an FCG and the associated feature space, such as the 21,986 dimensions identified in \malscan, create a vast perturbation space. Random perturbation approaches are inefficient in such a large space. Therefore, an effective optimization strategy is essential to navigate and exploit this expansive perturbation landscape efficiently.
% \textbf{Missing Gradient Information (C3)}: While gradient-based methods have been demonstrated in adversarial attacks~\cite{shahpasand2020feature, xu2023ofei}, such strategies are not directly applicable in FCG-based attacks due to the discontinuity of the input space. Designing a fitness function, such as one based on the output of a neural network, could provide some guidance, but it risks falling into local optima given the large input space. Additionally, models like those based on KNN or ensemble methods are non-differentiable, which further complicates the use of model output for guidance. Thus, developing effective guidance mechanisms is needed.
% \section{Challenges by Systems' Nature}
% % \section{Theoretical Analysis and Challenges}
% % \revise{overview, never discuss from the nature of target systems (overlooked), theoretically analyze and proof with experiments (ref exp section).}
% % \S~\ref{XXXX}
% %1.如图1的①所示，由于空间逆转问题，我们难以直接在feature上进行修改，达到目标。因此，我们follow之前的工作[cite],对FCG施加扰动来影响它所embedding的特征向量。这些embedding方法中，每个特征代表一个图中的关键API函数或它的抽象形式，因此我们可以将feature与原始FCG的对应，尽管对应的feature值是难以推测的。因此，直观上，我们如果能在FCG上对这些与feature所对应的关键API函数进行修改，那么间接的，我们可以达到自由将feature的数值增加或降低。为了保持语义不变的要求，我们仅能改动用户自定义的函数：增加、删除或调用系统函数。这导致我们的可修改区域并不能直接在FCG中我们希望去修改的区域，也就是说，我们对FCG中关键API函数的影响是间接施加的，这些间接施加的影响，再次经过复杂的embedding方法传递到feature。由于过多的层次关系和层次之间的非线性转换，我们难以推测我们在用户自定义函数中的扰动是能影响到我们希望扰动的feature.
% %2.如图1的②所示，在对用户自定义的点进行改动时，往往它们的范围是比对关键的系统函数修改更大的。而且，由于每个边和点存在的状态有2种，导致我们在用户自定义点的区域进行修改时，可能的修改方案会随着边数和点数的增加，变成一个树形结构，导致指数型爆炸。
% %3.如图1的③所示，我们现有针对FCG图的扰动操作，会造成遗传算法的基因冲突，由于他们是并行的从原图出发，对问题空间并行地探索可行解，在任意两个个体进行交流的时候，他们的基因会重组产生一个新的个体，这时，两个操作可能是互斥的，图中两个个体，左边的对点b进行删除操作，右边的对点b进行加边操作，当这两个基因发生重组时，由于在第一步操作后点b已经不存在了，那么第二步操作就会产生一个冲突，导致基因片段丢失。过多的丢失会造成失去优秀个体，降低多样性，降低收敛速度，解空间探索不足。
% %4.如图1的④所示，来自目标模型的反馈对于遗传算法的优化特别重要，而现有的方法采用模型置信度作为feedback可能会造成模型早熟和GA前进的方向是有随机性的问题。
% %1.模型置信度是模型的浅层反馈:模型置信度分数通常提供浅层反馈——基本上，只是模型认为输入是某一类的可能性有多大。这可能过于简单，因为它没有反映功能级别变化的复杂性和微妙性，而这些变化可能导致更严重的错误分类。
% % 模型置信度是模型的缺乏方向性:没有关于不同特征如何影响模型预测的详细反馈(SHAP值或扰动分析等细粒度反馈机制可能提供的东西)，遗传算法的信息有限。这导致了一种“盲目搜索”，即遗传算法在探索输入空间时缺乏明确的策略或方向，可能会在次优解决方案之间循环或振荡。
% \subsection{Attack vs Embedded Feature}
% \revise{1. limited editable contents in FCG, only user points are editable, others with value are not. (Malscan and Mamadroid);
% 2. non-fixed dimensions with different embedding methods (Malscan and Mamadroid);
% 3. no direct projection between mutation (attack) and feature (Malscan).}
% \begin{tcolorbox}[left=3pt, right=3pt, top=2pt, bottom=2pt]
% \label{insight:2}
% \small
% \hypertarget{}
% {\textbf{Challenge \#X}}:
% \textit{XXXX
% }
% \end{tcolorbox}
% \subsection{Attack vs Trained Model}
% \revise{Attack method not align with model's nature (what nature). The output of the linear model is continuous, but others are discrete;
% 1. non-linear models' score is irrelevant to decision-making (closer to decision boundary or not), cannot guide attack well. (1) tree (RF, ADB), cannot, why; (2) KNN, partially, why).
% 2. linear models' score leads to premature convergence. (1) MLP, why.}
% \subsection{Attack vs Semantic-preserved Mutation}
% 1. mutation conflict
% 2. mutation pattern
% \section{Methodology}\label{methodology}
% In this section, we detail our methodology designed to generate adversarial FCGs that address the primary challenges illustrated in \S~\ref{sec:challenge}.
\vspace{-5pt}
\section{Overview of \tool}\label{methodology:overview}
% \vspace{-4pt}
\begin{figure*}
\centering
\includegraphics[width=\linewidth]{figure/overview_dec23.png}
% \vspace{-10pt}
\caption{Overview of \tool.}
\label{fig:overview}
\vspace{-10pt}
\end{figure*}
Figure~\ref{fig:overview} illustrates the main workflow of \tool, which includes identifying critical areas of the FCG and optimizing perturbations within these areas using a GA.
{\textbf{Step 1}}: Initially, \tool extracts the FCG from the malware's smali files. Given the challenge of navigating the vast perturbation space within an FCG, we first identify the critical area relevant to malware behaviors for {effectively reducing the vast perturbation space.}
%Specifically, since malware behavior often relies on sensitive system APIs, \tool performs a reverse traversal from these nodes. This process identifies the critical area, including nodes and edges that impact these sensitive nodes, thus significantly influencing model predictions and effectively reducing the vast perturbation space.
% Recognizing the \ssw{\textit{main challenge}},
%of the vast potential perturbation space arbitrary modifications are deemed ineffective.
%(\textbf{Step 1}).
% With the critical area defined, \textbf{Step 2} involves deploying the GA to optimize perturbations focused on this region.
\textbf{Step 2}: \tool employs a GA to optimize perturbations in the identified critical area. For better exploration in the perturbation space, we incorporate seven semantics-preserving mutation operators on FCGs. Note that these mutation operators can be translated to code-level mutation that does not affect the original functionality.
% including four from previous studies \cite{zhao2021structural} and three newly developed ones.
The optimization aims to identify a \textit{sequence} of operators that orderly perturbs the FCG. Each individual in the GA population represents a perturbation sequence, enabling the mutation of diverse FCGs.
% \ssw{
% which consists of various combinations generated by the seven operators, enhancing the diversity of the new FCGs.
% The use of seven distinct mutation operators, along with their combinations in a sequence, significantly enhances the diversity of the newly generated FCGs.
%由于GA的并行探索，直接应用这些sequence在FCG上可能是不可行的。
% The direct application of crossover and mutation to this sequence may compromise the validity of perturbations.
\begin{itemize}[leftmargin=*]
\item {Step 2.1}: However, directly applying crossover and mutation at the level of perturbation operators to generate offspring may lead to \textit{invalid} perturbations. For example, an \textit{Add Edge} operator may become infeasible if its prerequisite node has been removed by an earlier operator within the same sequence.
To address this issue, we perform a dependency analysis and group dependent operations into sub-sequences, ensuring the validity of the perturbation sequence.
\item {Steps 2.2 and 2.3}: Crossover and mutation processes are then performed at the level of sub-sequences to ensure the dependency.
{Additionally, we propose a conflict-resolving mechanism to address any conflicts within a sequence after crossover and mutation.}
\item {Step 2.4}:
% We then evaluate the new individuals and select superior offspring.
{The new individuals are evaluated to calculate their fitness, selecting the best candidates for the next iteration or stopping if optimal conditions are met in the current iteration.}
% A challenge lies in the design of the fitness function, especially considering the different model types (Challenge \textit{C3}).
%为了获取更细粒度的反馈for解决the main challenge，我们考虑了不同模型的类型，然后设计了模型特定的fitness function。
{To obtain more useful feedback, we design model-specific and explanation-based fitness functions:}
% We design model-specific fitness functions:
a multi-objective score for MLP classifiers, a surrogate model approach for instance-based classifiers, and a constraint-based solution for decision tree classifiers.
If a perturbation sequence successfully bypasses the target model when applied to the FCG, it is recorded as a failure test (i.e., an adversarial sample). The sequence is finally applied to alter the APK's smali code, resulting in a malware that can be misclassified as ``benign''.
\end{itemize}
%ensuring that each operation's feasibility is preserved.
% Additionally, we propose a conflict-resolving mechanism after this process if any conflicts still within a sequence.
% After the crossover and mutation,
% Then, we evaluate the new individuals, selecting superior offspring based on their evaluation.
% \vspace{-0.15cm}
\section{Step 1: Critical Area Identification}\label{methodology:critical_area_identification}
% \vspace{-0.15cm}
To mitigate the issue of search space explosion, we propose a specialized critical area identification method designed for FCG-based embeddings.
This method efficiently pinpoints nodes and edges sensitive to perturbations that have notable impacts on detector outcomes, {thereby reducing the search space during GA optimization. }
An FCG is obtained through static analysis of the smali code from the decompiled APK.
% Nodes in the FCG can be categorized as system nodes and user nodes, corresponding to SDK-defined functions (i.e., APIs) and user-defined functions, respectively.
{Nodes in the FCG are categorized as system nodes (SDK-defined functions, i.e., APIs) and user nodes (user-defined functions).}
%许多调用关系会发生在FCG中，但是用户点只能调用用户点或者系统点，而系统点只能被调用。恶意软件通常调用敏感的系统APIs来达到恶意的目的，因此FCG-based AMD通常只关注系统点。而为了保持功能不变，我们扰动的只能是用户点。因此，为了定位到受敏感系统节点影响的特征，我们的扰动方法从识别恶意软件FCG中的这些节点开始，通过匹配过程精确定位包含敏感API的节点。然后，我们从这些节点进行反向遍历，识别前面的节点和边，将这些连接区域定义为关键区域。在后续的基于GA的优化过程中，这些区域被优先处理，以确保有效的扰动。
% \ssw{Calls typically occur between user nodes or from user nodes to system nodes, while system nodes can call each other but cannot call user nodes.}
% Calls typically occur between system nodes and user nodes, with user nodes capable of calling system nodes unidirectionally.
Malware often invokes some sensitive system APIs to achieve malicious objectives (e.g., accessing user contacts).
{In other words, malicious calls typically occur from user nodes to system nodes.}
{Therefore, FCG-based AMD typically prioritizes the user function calls that can invoke system APIs.}
% \fei{check the following sentence, not easy to understand}
%为了定位那些可以调用关键system APIs的user function call，我们首先在图中match那些代表关键的system APIs的nodes，然后从这些nodes开始逆向的遍历整个FCG。
{To locate user function calls that can invoke critical system APIs (e.g., 21,986 sensitive APIs in \malscan and 11 family states in \mamadroid)}, we first identify the nodes representing these critical system APIs in the graph, and then perform a backward traversal from these nodes to identify preceding nodes and edges, defining these connected regions as the \textit{critical area}. Note that the perturbation can only be performed in the user functions.
% \ssw{To identify critical system nodes that can influence features ,
% we identify these nodes within the malware's FCG through a matching process, precisely pinpointing nodes that contain sensitive APIs.
% We then perform a backward traversal from these nodes to identify preceding nodes and edges, defining these connected regions as the \textit{critical area}.
This area will be used for the subsequent GA-based optimization process.
% The area is prioritized in our subsequent GA-based optimization process.
% \vspace{-0.25cm}
\section{Step 2: Perturbation Optimization}
% \vspace{-0.15cm}
\subsection{Basic Perturbation Operators}\label{sec:perturbation}
% \vspace{-0.1cm}
Given an FCG $G=(V, E$), the nodes $V$ include both system nodes
%(i.e., system APIs $V_s$)
$V_s$
and user nodes
%(i.e., user-defined functions $V_u$)
$V_u$
and an edge $(v_1, v_2)\in E$ shows the calling relationship between the two functions (with the caller $v_1$ and the callee $v_2$). In an FCG, user nodes can act as callers or callees, while system nodes can only serve as callees.
To modify the FCG, we integrate seven semantic-preserving and code-level perturbation operators. {
The first four operators are based on prior work~\cite{zhao2021structural}, and we briefly introduce these four operators:}
% have been proven to maintain the functionality of an APK based on rules for mapping graph modifications back to smali code. More details in the paper \cite{zhao2021structural}.
% \vspace{-0.15cm}
\begin{itemize}[leftmargin=*]
% \item \textit{Add Node:} This operator involves creating a new function $i$ and selecting a user node $a\in V_u$ to invoke $i$. Consequently, a new node $i$ and new edge $(a,i)$ are added to $G$. The new function $i$ is designed to perform non-functional operations (e.g., basic mathematical calculations) to ensure that it does not affect the overall functionality.
\item \textit{Add Node:} This operator creates a new function $i$ and selects a user node $a\in V_u$ to invoke $i$. Consequently, a new node $i$ and new edge $(a,i)$ are added to $G$.
The new function $i$ is designed to perform non-functional operations (e.g., basic mathematical calculations) to ensure that it does not affect the overall functionality.
\item \textit{Add Edge:} This operator establishes a new calling between two existing functions, $i\in V_u$ and $f\in V$, resulting in a new edge $(i, f)$ within $G$.
To maintain original functionality, strategies such as using \textit{try-catch} blocks~\cite{li2023black} and unreachable conditions~\cite{zhao2021structural} ensure that the callee $f$ is never invoked, even though the calling is in the $G$.
% \item \textit{Rewire:} This operator removes an existing edge $(a, d)$ and selects a user node $h\in V_u$ as an intermediary to reconnect $(a, d)$. This adds two new edges: $(a, h)$ and $(h, d)$, where $(a, h)$ indicates the caller $a$'s invocation to intermediary $h$, and $(h, d)$ signifies $h$'s invocation to the original callee $d$. Special branches are added to related functions to ensure that original invocations of $d$ and $h$ remain unaffected.
\item \textit{Rewire:} This operator removes an existing edge $(a, d)$ and selects a user node $h \in V_u$ as an intermediary, adding two new edges: $(a, h)$ and $(h, d)$, where $(a, h)$ is $a$'s invocation to $h$, and $(h, d)$ is $h$'s invocation to $d$.
Special branches are added to related functions to ensure the original invocations of $a$ and $d$ remain unaffected.
% \item \textit{Remove Node:} This targets a user node $d\in V_u$ for removal. It identifies all original callers $\{h|(h, d)\in E\}$ and replaces the invocation statements with $d$'s function body. Subsequently, node $d$ and its connecting edges $\{(h,d)\in E|h \in V\}$ are removed. New edges $\{(h,v)| (h,d)\in E \wedge (d,v)\in E\}$ are added to the FCG, where $h$ is the original caller of $d$ and $v$ is its callee.
\item \textit{Remove Node:} This operator removes a user node $d\in V_u$.
For maintain functionality, it identifies all original callers $\{h|(h, d)\in E\}$ and replaces the invocation statements with $d$'s function body in the code.
Correspondingly, the edges $\{(h,d)\in E|h \in V_u\}$ are removed, and new edges $\{(h,v)| (h,d)\in E \wedge (d,v)\in E\}$ are added to the $G$, where $h$ are the original callers of $d$ and $v$ are its callees.
\end{itemize}
% \ssw{Among these, four existing operators are \textit{Add Node}, \textit{Add Edge}, \textit{Rewire}, and \textit{Remove Node}. These operators have been proven to maintain the functionality of an APK based on rules for mapping graph modifications back to smali code. More details in the paper \cite{zhao2021structural}.}
% where four are adapted from existing works \cite{zhao2021structural} and three are newly developed.
%(as depicted in Figure~\ref{fig:mutation_operators}).
% First, we briefly introduce the four existing perturbation operators. For details, refer to the original paper \cite{zhao2021structural}:
% While the existing four operators effectively influence key features such as the centrality of sensitive nodes identified by \malscan in simpler models (e.g., MLP), their impact diminishes in more complex models, particularly ensemble models like Random Forest, where key features are often sparse.
% \feng{The main problem from SP reviews is advanced operators were considered as a simple group of basic ones, which looks like something made up for 'novelty' (not convincing enough to be accepted as a necessary method).
% Can we demonstrate the new operators in new ways? e.g., operation aggregation/elimination with specific methodology/rules (highlight this)?}
% \ssw{While the existing four operators effectively influence features with simpler models (e.g., MLP), their impact diminishes in more complex models (e.g., Random Forest), especially with \malscan which are sparser than others.
% Ensemble models are inherently more robust, requiring more substantial changes to feature values to impact the model’s behavior.
% This sparsity means there are few system nodes we can affect, making the basic four operators often unable to significantly change feature values, even with many operations.
% This easily lead the GA to converge prematurely to local optima.}
However, these operators are very basic and insufficient for modifying features, particularly those in robust models (e.g., \malscan, which is sparser than others), often leading the GA toward local optima. Therefore, we introduce three new perturbation operators designed to substantially affect features:
% for particularly robust models,
% For instance, in an FCG that contains only one sensitive node, basic operators such as \textit{AddNode} might not adequately influence these sparse features.
% Moreover, in such ensemble models, it's challenging to construct influential patterns from basic operators due to GA's random nature.
% This can lead the GA to converge prematurely to local optima, ultimately failing to alter the model’s predictions.
% \begin{figure}[!t]
% \centering
% \includegraphics[width=0.8\linewidth]{figure/operator_new.png}
% \caption{Perturbation Operators}
% \label{fig:mutation_operators}
% \end{figure}
\begin{itemize}[leftmargin=*]
\item \textit{Add Sparse Nodes:}
{This operator adds $k$ nodes ${v_1, v_2, \ldots, v_k}$ to the $G$ \textit{at once}.
To affect the area around an existing node $a \in V_u$, edges
$(a, v_1), (a, v_2), \ldots, (a, v_k)$ are added.
This dilutes the centrality of other nodes and redistributes the influence across the $G$.}
\item \textit{Add Dense Nodes:}
{This operator first performs the \textit{Add Sparse Nodes} operator, then adds new edges $\{(v_i, v_j)| i< j \wedge i,j\in[1,k]\}$ to the $G$.
This effectively creates a dense subgraph, decreasing the relative importance of other paths in the $G$, which is particularly impactful for path-based analysis methods (e.g., Katz in \malscan).}
\item \textit{Add Long Edges:}
{This operator adds $m$ long edges between two existing nodes $a \in V_u$ and $f\in V_s$. For each long edge, $k$ new nodes ${v_1, v_2, \ldots, v_k}$ are added sequentially, creating the edges
$(a, v_1), (v_1, v_2), \ldots, (v_{k-1}, v_k)$, and finally an edge $(v_k, f)$ to create a path between $a$ and $f$.
This increases the number of paths leading to $f$ in $G$, significantly boosting its centrality in the network.}
% This significantly boosts the importance of the $f$ in the $G$ by increasing the number of paths leading to it, thereby enhancing its centrality in the overall network.
\end{itemize}
These three operators are based on the combinations of four basic operators, thus still ensuring the functional integrity of the APK.
Differently, they introduce a greater magnitude of perturbation for affecting the graph's features by allowing for the adjustment of parameters (e.g., $k$), which increases the population's diversity and helps avoid the risk of GA falling into local optima (see results in \S \ref{evaluation:RQ3 ablation}).
% Therefore, the three new operators are effective in the more robust ensemble models (i.e., Random Forest and AdaBoost) (details in \S \ref{evaluation:RQ3 ablation}).}
\textbf{Translating FCG-Based Mutation to Code-Level Perturbation.} It is essential to convert FCG-based mutations into code-level modifications. These modifications should be repackaged into an APK that retains the same functionalities as the original. Specifically, the mutation in the FCG can be mapped to corresponding changes in the code as follows\footnote{More detailed illustration and code change examples can be found in~\cite{zhao2021structural}.}:
\begin{itemize}[leftmargin=*]
\item \textit{Add Node}: We introduce a new function (i.e., node $i$) in the code that does not affect the original functionality (e.g., only printing or simple calculation like \( int j = j + 1 \), and then returns \( j \). The existing function (i.e., the user node $a$ in FCG) is modified to call this new function, but it does not process or utilize any of the returned value, thereby preserving the semantics of original function.
\item \textit{Add Edge}: We add an invocation from a user function \(a\) to any other function \(b\). To guarantee the functionality of original function \(a\), we can prevent the actual execution of function \(b\) by introducing a \(condition\) parameter in \(b\) and insert an \(if\)-\(else\) statement in its function body. When the function \(a\) invokes \(b\), \(condition\) is set to \(true\), causing \(b\) to return a value immediately, without executing the original logic in \(b\). For invocations from \(b\)'s original callers, \(condition\) is set to \(false\), allowing \(b\) to execute its original logic, thereby preserving the original functions.
\item \textit{Rewire}: We replace an existing call from function \(a\) to function \(c\) with an intermediary function \(b\), so that the call flow becomes \(a \rightarrow b \rightarrow c\).
To achieve this, we replace \(a\)’s call to \(c\) with a call to \(b\) and add a call to \(c\) within \(b\). To ensure \(b\)’s original callers remain unaffected, we apply a strategy similar to \textit{Add Edge}, i.e., using a \(condition\) parameter.
% \(b\) is modified to include a \(condition\) parameter and an \(if\)-\(else\) statement. If the call to \(b\) originates from \(a\), \(condition\) is set to \(true\), triggering the call to \(c\). For calls from \(b\)’s other original callers, \(condition\) is set to \(false\), allowing \(b\) to execute its original logic.
\item \textit{Remove Node}: We delete function \(a\), which results in the removal of all calling relationships involving \(a\) in the original graph. To ensure that the program logic remains unaffected, we copy \(a\)'s function body into all its caller functions as an inline code implementation. Consequently, in the final graph, direct connections are established between \(a\)'s original callers and its callees.
\item \textit{Add Sparse Nodes}:
We insert \(k\) functions simultaneously, all of which are called by a single existing function \(a\). To maintain original program semantics, similar operations as in the \textit{Add Node} process are applied.
\item \textit{Add Dense Nodes}:
We start by performing the same operation as in \textit{Add Sparse Nodes}. Then, for the newly added \(k\) functions, we sequentially connect them with calls. Throughout this process, we apply the same method as in the \textit{Add Edge} operation to ensure that program semantics remain unchanged.
\item \textit{Add Long Edges}:
Suppose we only insert a long edge, we insert $k$ intermediate functions between an existing function \(a\) and function \(c\), creating a nested call sequence. Essentially, this establishes a chain of function calls, where \(a\) calls the first intermediate function, which in turn calls the next, and so on, until reaching \(c\). These intermediate $k$ functions are newly added and serve solely as proxies, relaying the call from \(a\) to \(c\) without affecting any other existing functions or altering the program’s original functionality.
\end{itemize}
Note that our approach mainly utilizes FCG-based mutations instead of arbitrary direct code mutations (e.g., transforming \(m=m*2\) to \(m = m << 1\)). This is because we focus on FCG-based AMDs that rely solely on the features of the FCG. Arbitrary code mutations may not always impact the FCG, and therefore, might not effectively influence robustness.
% \vspace{-0.35cm}
\subsection{Step 2.1: Individual Representation}\label{methodology:individual_representation}
% \vspace{-0.15cm}
To initialize the GA's population, a simple way is to initialize each individual as a sequence of perturbation operators ($o_1, o_2, \ldots, o_n$), where $o_i$ denotes one of the seven available perturbation operators. The sequence is then applied to the FCG $G$ to generate a new FCG $G'$.
\begin{figure}[!t]
\centering
% \vspace{-0.1cm}
\includegraphics[width=0.8\linewidth]{figure/test.png}
% \vspace{-0.2cm}
\caption{Crossover with/without Dependency Strategy.}
\label{fig:dependency_example}
\vspace{-0.4cm}
\end{figure}
However, dependencies among operations often result in the generation of invalid perturbation sequences during crossover and mutation processes. {For example, as shown in the top of Figure~\ref{fig:dependency_example}, two sequences of individuals undergo crossover, creating an infeasible sequence in the new individual. Without the $AddNode(i)$ operator, the $RemoveNode(i)$ operator becomes infeasible as the node $i$ does not exist in the $G$. This issue can also arise during mutation, which greatly affects the testing efficiency.
{To address this issue, we propose a dependency-aware representation to avoid operator conflicts during crossover and mutation processes.
The approach involves a preliminary dependency analysis, grouping dependent operations into sub-sequences. Then crossover and mutation are performed at the level of sub-sequence.}
% (see the bottom part in Figure~\ref{fig:dependency_example}).
To identify the dependent perturbations, we develop a greedy-based method (see the detailed algorithm on the website~\cite{ourwebsite}) to check for dependencies between current operator $o$ and the existing sub-sequence $Seq$. If $o$ shares dependencies with any operators in $Seq$, it is added to that group; otherwise, $o$ is placed into a new sub-sequence, indicating no dependencies with existing groups. Specifically, dependency checking involves a use-def analysis~\cite{tok2006efficient} where the target nodes $V'$ and edges $E'$ created by an operator $o'$ (the definition) are examined against the usage in operation $o$.
If $o$ utilizes any nodes or edges defined by $o'$, a dependency exists.
Taken the example in the bottom part of Figure~\ref{fig:dependency_example}, $AddNode(i)$ defines node $i$, and $RemoveNode(i)$ uses node $i$, establishing a dependency that necessitates grouping these operations together as an atomic operation to ensure safe crossover and mutation.
%这段话的作用是什么
% Note that the initial sequence ($o_1, o_2, \ldots, o_n$)
% can be guaranteed to be valid through an on-the-fly check.
% Specifically, starting with the FCG, a valid operation is randomly selected that can feasibly be applied to the current state of the FCG. After applying the operation, the FCG is updated accordingly. Subsequent operations are then chosen based on this updated FCG, ensuring each selected operation remains feasible.
{Note that, during the GA initialization, the initial sequence ($o_1, o_2, \ldots, o_n$) is guaranteed to be valid through the on-the-fly check.
Specifically, starting with the initial graph $G$, a valid sub-sequence is randomly selected that can feasibly be applied to the current state of $G$. After applying this sub-sequence, the $G$ is updated to $G'$. Subsequent operators are then chosen based on this updated $G'$, ensuring each selected operator remains feasible.}
% The FCG is then updated, and subsequent operations are chosen based on this updated state, ensuring feasibility throughout.
% Subsequent operations are then chosen based on this updated FCG, ensuring each selected operation remains feasible.
During GA iterations, the generation of individuals differs significantly from this initial process. Instead of being generated on-the-fly, the entire sequences in individuals are first constructed (with crossover and mutation) and then evaluated later. It introduces the problem in maintaining the feasibility of each operator within the sequence. Our dependency analysis is designed to mitigate this challenge in crossover and mutation.
% \vspace{-0.1cm}
\subsection{Step 2.2 and 2.3: Crossover and Mutation}\label{methodology:crossover_mutation}
% \vspace{-0.1cm}
Once dependency-aware individuals are established, crossover and mutation processes are conducted at the sub-sequence level. This approach is crucial for maintaining the integrity of dependent operators within each individual.
\textbf{Crossover.}
Sub-sequences that contain dependent operators are randomly selected either to be retained or removed in their entirety from the new individual during the crossover process. This method helps prevent conflicts that could arise from breaking apart interdependent operations (see step 2.2 in Figure~\ref{fig:overview}).
\textbf{Mutation.}
% Mutation aims to enhance the diversity of the GA's population.
As shown in step 2.3 of Figure~\ref{fig:overview}, a sub-sequence is randomly chosen, and one of three types of mutations is applied: \textit{adding}, \textit{removing}, or \textit{updating}.
{\textit{Adding} involves inserting a new operator at a randomly selected position within a random sub-sequence, while \textit{removing} deletes the operator at that position.
\textit{Updating} involves replacing an existing operator within the sub-sequence with another random operator.}
{Due to the possibility of disturbing the dependency of the sequence, we then perform an on-the-fly dependency check for operators.
If a mutation renders subsequent operators infeasible, such as by altering dependent nodes or edges, we use a fix strategy. Problematic operators may be modified to fit the new context (e.g., changing an edge or node) or removed from the sequence. If the fix fails, the mutation is abandoned.}
% If a mutation renders subsequent operators infeasible, for example, if it removes or alters nodes or edges on which these operators depend, we adopt a fix strategy. The problematic operators might be modified to adapt to the new context (e.g., changing one edge or node), or removed from the sequence. If a fix is not successful, the current mutation will be abandoned.
% \vspace{-0.25cm}
\subsection{Step 2.4: Evaluation and Selection}\label{methodology:fitness}
% \vspace{-0.15cm}
{After crossover and mutation in the GA, we obtain new individuals as offspring. The fitness function is crucial for selecting superior individuals from the offspring.}
The typical fitness function in adversarial attacks uses the model's output to decrease the prediction probability of the current class or increase that of the target class~\cite{ma2021graph, li2023black}.
However, relying solely on model output may not be effective in the context of AMD attacks, especially due to the non-differentiability of instance-based models and decision trees. Specifically, it can lead to premature convergence (i.e., all yield similar probability values), particularly if the model consistently exhibits high confidence in classifying certain samples as malicious.
% \vspace{-0.25cm}
\subsubsection{Fitness for MLP Model}\label{fitness_mlp}
To overcome this challenge, we introduce an additional guidance mechanism based on feature interpretation, i.e., SHAP~\cite{SHAP2017}, a popular technique for understanding feature importance.
% This approach informs and directs the optimization~\cite{fan2020can, liu2022explainable, soi2024enhancing, severi2021explanation},
% as SHAP values indicate the importance of each feature in a model's prediction.
Features with positive SHAP values positively contribute to the prediction, whereas negative SHAP values indicate a negative contribution.
When the GA encounters local optima without observable changes in model output, SHAP values allow us to monitor feature-level changes, offering a finer-grained criterion for selection. Specifically, \textit{if an individual increases the value of features with negative contributions or decreases the value of features with positive contributions, the prediction is closer to failure}, even if the probability output remains unchanged.
We define a multi-objective fitness function as follows:
% \vspace{-0.22cm}
\begin{equation}
\footnotesize
% \hspace{-2mm}
\begin{aligned}
fitness1(I) = M(E(G+I)) \\
fitness2(I) = - \sum_{i=0}^{n-1} SHAP(M, G, I)_i \cdot (E(G)_i - E(G+I)_i)
\end{aligned}
% \vspace{-0.18cm}
\end{equation}
where $I$ is a given individual (i.e., perturbations), $G$ is the original FCG, $E(G)$ is the embedding vector of the $G$ with length $n$, $M(E(G+I))$ is the probability of the benign class and $SHAP(M, G, I)$ represents the SHAP values of features.
The $fitness1$ evaluates the model's target class probability. The $fitness2$ measures the potential for classification changes, with $SHAP(M, G, I)_i$ indicating the direction (positive or negative) and $E(G)_i - E(G+I)_i$ quantifying the change in the $i$-{th} feature value due to perturbation $I$.
\textbf{Dominance and Selection.}
We define a dominance relation for selection based on the two scores. An individual $x$ is said to dominate another one $y$ if and only if:
% \vspace{-0.18cm}
\begin{equation}
\label{eq:dominance}
\footnotesize
\begin{aligned}
fitness1(x) > fitness1(y) \vee \\
fitness1(x) == fitness1(y) \wedge fitness2(x)>fitness2(y)
\end{aligned}
% \vspace{-0.18cm}
\end{equation}
\vspace{0.1cm}
We prioritize individuals with higher benign probability scores or, when scores are equal, those that modify feature values in the most beneficial direction.
% \vspace{-0.25cm}
\subsubsection{Fitness for Instance-based Model}
For instance-based learning models (e.g. KNN), the main challenge is the lack of gradient information. To approximate gradients for KNN, we employ a surrogate model (e.g., an MLP model), which facilitates the use of an interpretation-based approach (see \S \ref{fitness_mlp}) alongside the model output.
For a KNN model $M$, where the adversarial challenge is to manipulate the instance such that it resembles benign samples more closely than malware samples, we train a surrogate model $M'$. This allows us to derive a dual-score fitness function, as follows:
% \vspace{-0.25cm}
\begin{equation}
\footnotesize
% \hspace{-2.7mm}
% \vspace{-0.15cm}
\begin{aligned}
fitness1(I) = \frac{1}{x} \sum_{i=1}^{k} (M(I)^m_i - M(I)^b_i) \\
fitness2(I) = - \sum_{i=0}^{n-1} SHAP(M', G, I)_i \cdot (E(G)_i - E(G+I)_i)
\end{aligned}
\end{equation}
where $k$ represents the number of neighbors considered in KNN. $M(I)^m_i$ denotes the distance to the $i$-th nearest malware sample, and $M(I)^b_i$ denotes the distance to the $i$-th nearest benign sample.
The $fitness1$ aims to increase the similarity to benign neighbors and decrease the similarity to malware neighbors, effectively manipulating the prediction of the adversarial example. The second fitness function $fitness2$, similar to that used for target MLP models (\S ~\ref{fitness_mlp}), utilizes SHAP values estimated by the surrogate model $M'$ to assess the impact of perturbations on feature importance. The selection follows the dominance relation defined in Equation~\ref{eq:dominance}.
% \vspace{-0.2cm}
\subsubsection{Fitness for Ensemble Model}
% Ensemble models (e.g., Random Forest) determine the model output probability through a voting process among numerous decision trees. Each tree in the model selects a subset of features to use as decision nodes (i.e., tree split nodes~\cite{song2015decision}). This selection makes altering the output values of tree models during adversarial attacks particularly challenging, especially when only a few or none of the selected decision features are present in the target sample. In such cases, it is unlikely to change the overall model output (i.e., the decision of the majority of trees) as the key decision features may remain unaffected.
Ensemble models like Random Forest determine output probabilities through a voting process among numerous decision trees, each selecting a subset of features for decision nodes (tree split nodes)~\cite{song2015decision}. Altering tree-based model outputs during testing is challenging, especially when only a few or none of the selected decision features are present in the target sample. Consequently, changes in the overall model output (i.e., the decision of the majority of trees) are unlikely if key decision features remain unaffected.
To overcome this challenge, we directly examine the constraints associated with the decision features. By analyzing the decision paths of all decision trees, we identify all possible feature constraints that could result in a benign output, as our goal is to have the target model misclassify the malware as benign. We will eliminate the constraints that conflict with those from other decision trees. Finally, our objective is to maximize the number of constraints that the perturbed inputs can satisfy, thereby increasing the likelihood of a benign classification. The fitness function is defined as follows:
% \vspace{-0.15cm}
\begin{equation}
\footnotesize
fitness(I) = \sum_{c\in C} SAT(G, M, I, c)
% \vspace{-0.15cm}
\end{equation}
where $C$ represents all the constraints that can potentially lead to a benign output, and $SAT$ determines whether a given constraint $c\in C$ is satisfied (1) or not (0). The optimization process aims to generate perturbations that maximize the number of satisfied constraints.
\section{Evaluation}\label{sec:evaluation}
% \vspace{-0.1cm}
We aim to evaluate the effectiveness of \tool by answering the following research questions.
\begin{itemize}[label=-,leftmargin=*]
\item \textbf{RQ1}: How effective is \tool compared to others?
\item \textbf{RQ2}: What is the performance of \tool?
\item \textbf{RQ3}: How does each component of \tool impact the overall effectiveness?
% \item \textbf{RQ4}: Can \tool adapt to black-box scenarios?
\end{itemize}
% \vspace{-0.2cm}
\subsection{Experimental Setup}\label{evaluation:setup}
% \vspace{-0.1cm}
\noindent\textbf{Dataset.}
Since the datasets used in previous studies are not publicly available, we adhere to the very common methodologies described in prior works~\cite{zhao2021structural,li2023black} to collect datasets.
{The collected dataset includes 12,000 samples with 6,000 benign and 6,000 malware samples, divided into an 80:20 ratio for training and testing the models. To ensure representativeness, these collected samples are evenly distributed across six years, from 2018 to 2023, with 1,000 benign and 1,000 malware samples per year.} Similar to previous works~\cite{zhao2021structural, li2023black}, benign samples are sourced from AndroZoo~\cite{androzoo} (VirusTotal~\cite{virustotal} score of 0) and malware samples from VirusShare~\cite{virusShare} (VirusTotal score above 4).
To assess robustness, we additionally collected 120 true malware samples from the same six-year period (20 samples per year) as test seeds.
{These seed samples are distinct from the initial set of 6,000 malware samples. More details about dataset are available on our website~\cite{ourwebsite}.}
% Following the existing works~\cite{zhao2021structural,li2023black}, we collected the datasets for the evaluation. The collected dataset contains 12,000 samples, split 80:20 for training and testing the target models. Note that, it is balanced from 2018 to 2023 with benign samples from AndroZoo~\cite{androzoo} (VirusTotal score 0) and malware from VirusShare~\cite{virusShare} (VirusTotal score above 4).
% To evaluate the robustnees, we followed the similar procudre to collect another 120 true malware from 2018 to 2023, which are the seed for testing. Note that these seed malware has non-overlap with the 12,000 samples.
% {We first dataset includes 12,000 samples, split 80:20 for training and testing the target models. It is balanced from 2018 to 2023 with benign samples from AndroZoo~\cite{androzoo} (VirusTotal score 0) and malware from VirusShare~\cite{virusShare} (VirusTotal score above 4).}
% It includes half of benign samples from AndroZoo~\cite{androzoo} (2018-2023) with a VirusTotal~\cite{virustotal} score of 0, and half of malware samples from VirusShare~\cite{virusShare} (2018-2023) with a VirusTotal score above 4.
% It consists of 6,000 benign samples from AndroZoo~\cite{androzoo} with a VirusTotal~\cite{virustotal} score of 0 and 6,000 malware randomly chosen from VirusShare~\cite{virusShare} (2018-2023) with a VirusTotal~\cite{virustotal} score of above 4.
% Due to GPU memory limitations of one of the baselines (i.e., HRAT), the dataset size was constrained.
% \ssw{\textit{Dataset B} contains the seed for evaluating the attack methods, which contains 120 true malware (non-overlap with training set) from 2018 to 2023 averagely.}
% comprising 6,000 benign samples from AndroZoo~\cite{androzoo} and 6,000 malware samples from VirusShare~\cite{virusShare}. The data spans from 2018 to 2023, with 2,000 samples collected each year, split evenly between benign and malware. Each yearly set was divided into 8:2 train/test subsets, ensuring each model achieved an accuracy exceeding 90\%.
% \textit{Dataset A.}
% The first dataset is for training the target models.
% This dataset was created based on benign samples (6,000 in total) obtained from AndroZoo~\cite{androzoo} with a VirusTotal~\cite{virustotal} score of 0 and malware samples (6,000 in total) randomly chosen from VirusShare~\cite{virusShare}.
% Spanning six years from 2018 to 2023, we extracted 2,000 samples annually, split evenly between benign and malware, resulting in 1,000 samples per category. Therefore, we have six sets in total (6×2,000)\footnote{Due to one of the baselines (i.e., \hrat) being limited by the GPU memory size, the dataset cannot be too large.}. Each set was divided into 8:2 training and testing sets. We validated our attacks by ensuring the trained target models achieved average performance exceeded 90\% in Table~\ref{tab:model_eval}.
% \textit{Dataset B.}
% The second dataset is created to evaluate the attack methods by ensuring the malware samples contained are representative of various attack vectors.
% We created the dataset by selecting 20 true malware samples from each year between 2018 and 2023, totaling 120 as attack samples. These were not included in the training data of the target model, similar to other works~\cite{zhao2021structural,li2023black,he2023efficient}.
% This method guarantees a balanced temporal distribution to avoid bias.
% Due to the semantic integrity of requirements~\cite{wu2019malscan, onwuzurike2019mamadroid}, we cannot modify the system functions of samples.
% Therefore, if essential system functions, which are decision nodes in tree-based models, are absent in the attack samples, the model outputs will not change.
% This requirement renders over 90\% of our initial attack dataset theoretically unattackable, significantly limiting the effectiveness of tree-based models against adversarial manipulations.
% Considering these constraints, we specifically select a new set of 120 theoretically attackable samples for the tree-based models.
\noindent\textbf{Target Models.}
We invested significant efforts to include a wide range of models and features, ensuring a systematic and comprehensive evaluation of the testing methods. Specifically, we trained 40 (8×5) ML-based AMD models built upon 8 types of features, including the Degree, Katz, Harmonic, Closeness, Average, and Concentrate features from \malscan~\cite{wu2019malscan}, the family level from \mamadroid~\cite{onwuzurike2019mamadroid}, and the package level from \apigraph, alongside 5 ML-based classifiers: MLP~\cite{grosse2017adversarial}, KNN-1~\cite{fix1952discriminatory}, KNN-3, Random Forest (RF)~\cite{breiman2001random}, and AdaBoost (AB)~\cite{dai2018adversarial}. The performance of target models can be found on our website~\cite{ourwebsite}.
% We ensured the quality of target models, i.e., they achieve an average accuracy exceeding 90\%. The model details can be found on our website~\cite{ourwebsite}.
\noindent\textbf{Baselines.}
% \cs{here}
We selected three baselines for comparison: a random testing approach and two state-of-the-art adversarial attack methods~\cite{zhao2021structural,li2023black} for AMD. Due to the limited applicability of these state-of-the-art baselines or the unavailability of the code, we extended or re-implemented them based on the descriptions provided in their respective papers.
% Specifically, for \bagammo~\cite{li2023black}, which has not released its code, we replicated its algorithm based on the descriptions provided in their paper.
Specifically, for \bagammo~\cite{li2023black}, which has not released its code, we replicated its algorithm based on the descriptions provided in their paper.
{
To ensure a fair comparison with \tool, we configured \bagammo in a white-box setting, where feedback is obtained directly from the target model alongside a surrogate model. In the configuration referred to as \textit{BagAmmo-G}, we used a GCN surrogate model (the original model in this baseline) trained on ground truth data. Additionally, we experimented with using an MLP (the same surrogate model as in our method) in place of their original GCN, designated as \textit{BagAmmo-M}.
}
For \hrat~\cite{zhao2021structural}, although the code is available~\cite{hratcode}, it primarily addresses attacks utilizing Degree and Katz centrality metrics for \malscan on the KNN-1 model. We expanded its application to encompass a wider array of target scenarios. However, \hrat is limited by GPU memory constraints and the need for classifier differentiability~\cite{alzantot2019genattack, chen2020frank}, which restricts its use with tree-based models and memory-intensive features such as Average and Concentrate.
{Regarding the Random attack, it randomly generates perturbation operators and evaluates their effects when applied to the FCG.}
Further details about the baselines, including the source code, are available on our website~\cite{ourwebsite} and GitHub~\cite{ourcode}.
% This method uses four basic perturbation operators, randomly generating 300 perturbation operators and applying them to the original FCG. The maximum number of iterations is 100.
% Since \bagammo~\cite{li2023black} has not disclosed the code, we reproduced a GA based on the descriptions in their paper. We used a five-layer GCN as a substitute model, where the GCN features include graph edges along with the nodes' in-degrees and out-degrees.
% \textit{Random Attack.}
\noindent\textbf{Metrics.} We employed three widely used metrics: Attack Success Rates (ASR), Perturbation Rates (PR) and Average Number of Survival Genes per Generation (ASGG). ASR measures the effectiveness of attack methods. PR quantifies the relative increase in graph components (i.e., nodes and edges) of adversarial samples compared with the original malware. Considering the potential conflicts that can result in certain infeasible perturbations (i.e., genes in the individuals), ASGG is designed to assess the count of genes that remain feasible (referred to as the `survival genes') following crossover and mutation in each generation.
\vspace{-0.1cm}
\begin{equation}
\vspace{-0.2cm}
\footnotesize
ASR = \frac{N_a}{N_m}, \
PR = \frac{1}{N_a} \sum_{i=1}^{N_a} \delta_i, \
ASGG= \frac{1}{G} \sum_{g=1}^{G} N_{g}
\end{equation}
where $N_a$ is the number of malware that can successfully bypass the AMDs, $N_m$ is the total number of seed malware,
$\delta_i = \frac{P_{add,i}}{P_{ori,i}}$ is the perturbation ratio for the $i$-th successful sample, reflecting the proportion of added nodes and edges, $G$ is the total number of generations and $N_{g}$ is the total number of surviving genes in the $g$-{th} generation.
\begin{table*}[!t]
\centering
\caption{Attack Success Rates of \tool and Baselines.}
% \vspace{-0.3cm}
\label{tab:RQ1_asr}
\resizebox{.99\textwidth}{!}{
% \small
\begin{tabular}{c|ccccc|ccccc|ccccc|ccccc}
\hline
\multicolumn{1}{l|}{} & \multicolumn{5}{c|}{\malscan (Degree)} & \multicolumn{5}{c|}{\malscan (Katz)} & \multicolumn{5}{c|}{\malscan (Harmonic)} & \multicolumn{5}{c}{\malscan (Closeness)} \\ \cline{2-21}
\multicolumn{1}{l|}{\multirow{-2}{*}{}} & MLP & KNN-1 & KNN-3 & RF & AB & MLP & KNN-1 & KNN-3 & RF & AB & MLP & KNN-1 & KNN-3 & RF & AB & MLP & KNN-1 & KNN-3 & RF & AB \\ \hline
\rowcolor[HTML]{CFE2F3}
\textbf{Ours} & \textbf{0.82} & \textbf{0.73} & \textbf{0.76} & \textbf{0.78} & \textbf{1.00} & \textbf{0.77} & \textbf{0.68} & \textbf{0.69} & \textbf{0.94} & \textbf{0.96} & \textbf{0.82} & \textbf{0.90} & \textbf{0.83} & \textbf{1.00} & \textbf{1.00} & \textbf{0.88} & \textbf{0.97} & \textbf{0.84} & \textbf{0.91} & \textbf{1.00} \\
\textbf{\hrat} & 0.14 & 0.18 & 0.08 & - & - & 0.01 & 0.03 & 0.01 & - & - & 0.01 & 0.03 & 0.01 & - & - & 0.01 & 0.12 & 0.18 & - & - \\
\rowcolor[HTML]{CFE2F3}
\textbf{\bagammo-M} & 0.58 & 0.57 & 0.50 & 0.02 & 0.07 & 0.24 & 0.23 & 0.16 & 0.01 & 0.03 & 0.70 & 0.66 & 0.61 & 0.37 & 0.09 & 0.77 & 0.67 & 0.59 & 0.13 & 0.13 \\
\textbf{\bagammo-G} & 0.65 & 0.61 & 0.28 & 0.03 & 0.06 & 0.43 & 0.22 & 0.05 & 0.00 & 0.03 & 0.73 & 0.67 & 0.58 & 0.33 & 0.08 & 0.74 & 0.64 & 0.56 & 0.05 & 0.08 \\
\rowcolor[HTML]{CFE2F3}
\textbf{Random} & 0.59 & 0.62 & 0.56 & 0.19 & 0.03 & 0.02 & 0.08 & 0.08 & 0.11 & 0.04 & 0.59 & 0.67 & 0.57 & 0.08 & 0.03 & 0.63 & 0.58 & 0.58 & 0.13 & 0.04 \\ \hline \hline
\multicolumn{1}{l|}{} & \multicolumn{5}{c|}{\malscan (Average)} & \multicolumn{5}{c|}{\malscan (Concentrate)} & \multicolumn{5}{c|}{Mamadroid} & \multicolumn{5}{c}{APIGraph} \\ \cline{2-21}
\multicolumn{1}{l|}{\multirow{-2}{*}{}} & MLP & KNN-1 & KNN-3 & RF & AB & MLP & KNN-1 & KNN-3 & RF & AB & MLP & KNN-1 & KNN-3 & RF & AB & MLP & KNN-1 & KNN-3 & RF & AB \\ \hline
\rowcolor[HTML]{CFE2F3}
\textbf{Ours} &
% & 0.90 & 0.92 & 0.83 & 0.91 & 1.00 & 0.87 & 0.91 & 0.78 & 0.94 & 0.96 & 0.96 & 0.99 & 0.93 & 1.00 & 0.98 & 0.83 & 0.84 & 0.84 & 0.78 & 0.72 \\
\textbf{0.90} & \textbf{0.92} & \textbf{0.83} & \textbf{0.91} & \textbf{1.00} & \textbf{0.87} & \textbf{0.91} & \textbf{0.78} & \textbf{0.94} & \textbf{0.96} & \textbf{0.96} & \textbf{0.99} & \textbf{0.93} & \textbf{1.00} & \textbf{0.98} & \textbf{0.83} & \textbf{0.84} & \textbf{0.84} & \textbf{0.78} & \textbf{0.72} \\
\textbf{\hrat} & - & - & - & - & - & - & - & - & - & - & 0.03 & 0.08 & 0.03 & - & - & 0.05 & 0.09 & 0.04 & - & - \\
\rowcolor[HTML]{CFE2F3}
\textbf{\bagammo-M} & 0.75 & 0.63 & 0.58 & 0.24 & 0.18 & 0.72 & 0.66 & 0.57 & 0.17 & 0.19 & 0.58 & 0.76 & 0.71 & 0.40 & 0.13 & 0.81 & 0.79 & 0.78 & 0.07 & 0.43 \\
\textbf{\bagammo-G} & 0.72 & 0.62 & 0.57 & 0.05 & 0.11 & 0.73 & 0.60 & 0.55 & 0.23 & 0.06 & 0.80 & 0.65 & 0.53 & 0.33 & 0.33 & 0.79 & 0.74 & 0.70 & 0.16 & 0.40 \\
\rowcolor[HTML]{CFE2F3}
\textbf{Random} & 0.61 & 0.62 & 0.58 & 0.08 & 0.03 & 0.66 & 0.60 & 0.58 & 0.20 & 0.03 & 0.09 & 0.12 & 0.03 & 0.13 & 0.14 & 0.47 & 0.14 & 0.03 & 0.05 & 0.09 \\ \hline
\end{tabular}
}
\vspace{-0.5cm}
\end{table*}
% \vspace{-0.1cm}
\subsection{RQ1: Effectiveness}\label{evaluation:RQ1 effectiveness}
% \vspace{-0.15cm}
\noindent\textbf{Setup.}
We initialize each population with 100 individuals for 40 generations, with each individual initializing with 300 perturbation operations. This configuration follows established precedents in the literature. According to \bagammo, the best attack success rate is achieved at 40 generations. Meanwhile, \hrat identifies 300 as the optimal number of perturbations. To enhance \hrat's performance and ensure fair comparisons, we increased the number of random initializations in \hrat from 16 to 100. The configuration for the Random attack remains consistent with the baselines previously described, involving 300 perturbations per iteration and a maximum number of 100 iterations.
\noindent\textbf{Results \& Analysis.}
As presented in Table~\ref{tab:RQ1_asr}, the results demonstrate that our attack method outperforms the baselines significantly, the results demonstrate that our attack method significantly outperforms the baselines, achieving an average ASR of 87.9\%, {which is at least 44.7\% higher than \bagammo-M (43.2\%), \bagammo-G (41.2\%), Random Attack (28.8\%), and \hrat (7.8\%).}
(1) Baseline Analysis:
%We found that \hrat generally performs poorly across most models, often yielding the ASR close to zero, especially in MalScan (Katz, Harmonic), \mamadroid, and \apigraph, where it is ineffective, which has a huge discrepency with their claimed in their paper, similar doubts in this survey~\cite{olszewski2023get} and its results\footnote{https://github.com/reproducibility-sec/reproducibility/blob/main/sheet1.csv}.
We found that \hrat generally performs poorly across most models, often yielding an ASR close to zero, especially in MalScan (Katz, Harmonic), \mamadroid, and \apigraph, where it is ineffective.
Furthermore, the results of \malscan (Degree and Katz) with KNN-1 show a significant discrepancy compared to the claims in their paper, with similar doubts raised in this survey~\cite{olszewski2023get} and its results.\footnote{https://github.com/reproducibility-sec/reproducibility/blob/main/sheet1.csv}
% We observed that during the model's forward propagation, the changes in feature values tend towards zero, leading to gradient vanishing, which is a well-known problem in training deep neural networks~\cite{liu2020loss, hameed2021gradient,liu2023enhancing}.
% It is particularly challenging when the detector uses different feature methods or models (e.g., KNN).
% To address this, it is necessary to carefully adjust specific parameters (e.g., learning rate) or optimize configurations (e.g., activation function)
% when switching between different feature methods or models, which requires a significant amount of human effort.
% Our analysis found that the primary limitation of \hrat is that the reward mechanism in reinforcement learning relies on coarse model scores and the inaccuracy of gradient estimation on the adjacency matrix.
% Consequently, this method struggles to adapt to diverse target models;
{Our analysis indicates that a primary limitation of \hrat lies in its RL reward mechanism, which relies on coarse model scores and suffers from inaccuracies in gradient estimation on the adjacency matrix. This lack of precise, granular feedback hinders the model’s ability to fine-tune perturbations across complex feature types and target models.
\bagammo-M and \bagammo-G perform well with \mamadroid and \apigraph feature types across MLP, KNN-1, and KNN-3 models, especially with MLP. However, their effectiveness drops significantly on tree-based models and \malscan, where they perform comparably to Random Attack. This reduction stems primarily from reliance on a single mutation operator and feedback based solely on coarse-grained scores from surrogate and target models. Although it claims GCN’s strengths with graph-structured data~\cite{li2023black}, adapting to tree-based models in AMD is challenging, as these models typically lack the relational structure that GCNs leverage. Please note that we observed a discrepancy between our evaluation results and those reported in the original paper.
We have made extensive efforts to investigate this issue and confirmed our results, as discussed in Section~\ref{threatstovalidity} and the explanations on our website~\cite{ourwebsite}.}
% \textbf{Finding #1:}
% \textit{Existing methods are
% notably ineffective, particularly on MalScan and ensemble models, with results that are close to random attacks.}
\vspace{-0.15cm}
\begin{tcolorbox}[left=1pt, right=1pt, top=0pt, bottom=0pt]
\label{insight:1}
\small
% \hypertarget{}
{\textbf{Finding \#1}}:
\textit{
Existing methods are notably ineffective, particularly on \malscan and ensemble models, with results that are close to random testing.
}
\end{tcolorbox}
% \vspace{-0.15cm}
% This decrease can be attributed to the fundamental design of GCNs, which are optimized for graph-structured data where node connections are crucial~\cite{sun2022adversarial}. In contrast, tree-based models in AMD often rely on features derived from static analysis that lack such relational structures. Furthermore, the extensive dimensionality of \malscan creates a larger search space compared to \mamadroid and \apigraph, which challenges the efficacy of \bagammo under these conditions.
% \vspace{-0.15cm}
% \begin{tcolorbox}[left=1pt, right=1pt, top=0pt, bottom=0pt]
% \label{insight:1}
% \small
% \hypertarget{}
% {\textbf{Finding \#1}}:
% \textit{
% %强化学习不适用于广泛的机器学习检测器。基于GCN的黑盒攻击不能在esemble model上产生有效的攻击。
% Gradient-based methods are not suitable for non-differentiable models. Black-box attacks using GCNs and single type of perturbation fail to produce effective attacks on ensemble models and \malscan.
% }
% \end{tcolorbox}
% \vspace{-0.1cm}
(2) Robustness Analysis:
There are noticeable variations in ASR across different feature types.
From the perspective of features, \malscan (Closeness and Average) and \mamadroid consistently exhibit high ASRs, typically exceeding 90\% across most classifiers, suggesting these features may be more susceptible to attacks. Conversely, features like \malscan (Degree and Katz) and \apigraph demonstrate greater robustness, with ASRs often below 80\%, likely due to the complexity of perturbing these features effectively; While ensemble models (i.e., RF and AB) generally show more robustness than single models (i..e, MLP and KNNs), our method still achieves high ASRs on \malscan (Harmonic) and \malscan (Closeness) features, proving its effectiveness even against complex models. However, in ensemble models, our method achieves relatively lower ASRs, notably less than 80\% on \apigraph, reflecting their resilience against attacks.
% \textbf{Finding #2:}
% \textit{\malscan (Closeness and Average) and \mamadroid are attack-prone, while \malscan (Degree and Katz) and \apigraph are more robust; Ensemble models (i.e., RF and AB) generally show greater robustness.}
\vspace{-0.15cm}
\begin{tcolorbox}[left=1pt, right=1pt, top=0pt, bottom=0pt]
\label{insight:2}
\small
% \hypertarget{}
{\textbf{Finding \#2}}:
\textit{
\malscan (Closeness and Average) and \mamadroid are less robust, while \malscan (Degree and Katz) and \apigraph are more robust; Ensemble models (i.e., RF and AB) generally show greater robustness.
}
\end{tcolorbox}
% \cs{Here, number}
% \tool significantly outperforms baseline approaches in white-box attack scenarios, achieving higher ASR across diverse target models. Furthermore, the results underscore the persistent susceptibility of current FCG-based ML/DL models to adversarial attacks, emphasizing the need for enhanced security testing.
\vspace{-0.25cm}
\begin{tcolorbox}[left=1pt, right=1pt, top=0pt, bottom=0pt]
\label{conclusion:1}
\small
% \hypertarget{}
{\textbf{Answer to RQ1}}:
\textit{\tool, with an average ASR of 87.9\%, outperforms baselines by at least 44.7\% in white-box attacks, achieving higher ASR across diverse models.
The results highlight the persistent vulnerability of current FCG-based ML models to adversarial attacks, emphasizing the need for robustness testing.
% \tool outperforms baselines in white-box attacks, achieving higher ASR across diverse models.
% The results highlight the persistent vulnerability of current FCG-based ML models to adversarial attacks, emphasizing the need for robustness testing.
}
\end{tcolorbox}
\vspace{-0.5cm}
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\begin{table}[!t]
\centering
\caption{Perturbation Rates of Successful Attack Samples.}
% \vspace{-0.2cm}
\label{tab:rq2_perturbation}
\resizebox{.48\textwidth}{!}{
\begin{tabular}{c|c|c|c|c|c}
\hline
\multicolumn{1}{l|}{} & MLP & KNN-1 & KNN-3 & RF & AB \\ \hline
\rowcolor[HTML]{CFE2F3}
\textbf{\malscan (Degree)} & 0.04 & 2.23 & 0.04 & 5.17 & 2.29 \\
\textbf{\malscan (Katz)} & 0.17 & 2.88 & 0.19 & 4.68 & \textgreater{}10 \\
\rowcolor[HTML]{CFE2F3}
\textbf{\malscan (Harmonic)} & \textbf{\textless 0.01} & 0.81 & \textbf{\textless 0.01} & \textbf{0.02} & \textbf{0.01} \\
\textbf{\malscan (Closeness)} & \textbf{\textless 0.01} & 0.52 & \textbf{\textless 0.01} & 0.68 & 1.58 \\
\rowcolor[HTML]{CFE2F3}
\textbf{\malscan (Average)} & \textbf{\textless 0.01} & \textbf{\textless 0.01} & \textbf{\textless 0.01} & 5.27 & 8.07 \\
\textbf{\malscan (Concentrate)} & \textbf{\textless 0.01} & 1.70 & \textbf{\textless 0.01} & \textgreater{}10 & \textgreater{}10 \\
\rowcolor[HTML]{CFE2F3}
\textbf{Mamadroid} & 0.45 & 0.45 & 0.14 & \textgreater{}10 & 4.85 \\
\textbf{APIGraph} & 1.31 & 0.26 & 0.14 & \textgreater{}10 & 3.07 \\ \hline
\end{tabular}
}
\vspace{-0.15cm}
\end{table}
% \vspace{0.1cm}
\subsection{RQ2: Performance}\label{evaluation:RQ2 performance}
% \vspace{-0.25cm}
\subsubsection{Perturbation Rates across Target Models}\label{evaluation:RQ2 performance:perturbation}
\hfill \\
\textbf{Setup.}
To measure the perturbation degree that \tool applies to original samples, we calculated the average PR across all adversarial samples for each target model.
\noindent\textbf{Results \& Analysis.}
As shown in Table \ref{tab:rq2_perturbation}, the successful adversarial samples on MLP and KNNs-based models exhibit relatively low PR, while higher PR on ensemble models.
Specifically, \malscan (Harmonic, Closeness, Average, and Concentrate) models achieved PRs below 0.01 with both MLP and KNN-3.
However, PRs for KNNs are slightly higher compared to MLP, suggesting MLP's less robustness. PRs for tree-based models (i.e., RF and AB) are notably higher, except for \malscan (Harmonic), where they are lower.
Instances of PRs exceeding 10 are observed, typically due to exceptionally large samples. For instance, in \malscan (Katz) under AB, 50\% of the samples are below 3, and 73\% are below 10.
% Overall, higher PRs indicate that ensemble models are more challenging to attack than KNNs and MLP models, yet the scale of applied perturbations in successful attacks remains within a reasonably acceptable range.
% \vspace{-0.15cm}
\begin{tcolorbox}[left=1pt, right=1pt, top=0pt, bottom=0pt]
\label{insight:3}
\small
% \hypertarget{}
{\textbf{Finding \#3}}:
\textit{Single models (i.e., MLP and KNNs) are generally easier to bypass, requiring fewer perturbations. In contrast, ensemble models (i.e., RF and AB) combine predictions from multiple models, making them more robust and necessitating greater perturbations to compromise.
}
\end{tcolorbox}
% \vspace{-0.15cm}
% \vspace{-0.05cm}
\subsubsection{Survival Genes during GA Iterations}\label{evaluation:RQ2 performance:survival_genes}
\hfill \\
\textbf{Setup.}
To assess the usefulness of the dependency-aware strategy (see \S ~\ref{methodology:individual_representation}) in reducing mutation conflicts, we calculated the ASGG after 40 iterations. Specifically, we randomly selected 20 malware and conducted experiments with and without the dependency analysis for comparative analysis.
% To prevent premature termganination of these samples, the evaluation phase of the GA was omitted.
% \vspace{-0.55cm}
\noindent\textbf{Results \& Analysis.}
The green and orange lines in Figure~\ref{fig:rq2_survival_genes} represent \tool's ASGG with and without the dependency-aware strategy, respectively. Throughout the iterations, the green line consistently maintains a higher ASGG compared to the orange line, with the difference doubling after the fifth generation. The orange line shows a noticeable bump between generations 30 and 35. Our analysis indicates that this increase can be attributed to the probabilistic introduction of a significant number of new genes by the mutation, leading to pronounced fluctuations.
% As detailed in \S~\ref{methodology:crossover_mutation}, our analysis shows that this increase can be attributed to the mutation process, which probabilistically introduces a significant number of new genes, potentially leading to pronounced fluctuations.
Following this bump, the ASGG quickly declines due to the absence of the dependency-aware strategy capable of preemptively resolving gene conflicts. In contrast, the green line remains more stable throughout the generations. This stability suggests that the strategy helps preserve the number of viable genes within the population, which could prevent premature convergence of the GA optimization. Stability in the gene pool is crucial because significant diminishment in genetic variety can impede the GA’s ability to generate new and potentially more effective individuals~\cite{squillero2016divergence}.
% \vspace{-0.15cm}
\begin{tcolorbox}[left=1pt, right=1pt, top=0pt, bottom=0pt]
\label{insight:4}
\small
% \hypertarget{}
{\textbf{Finding \#4}}:
\textit
{
The dependency-aware strategy protects critical genes from mutation conflicts, thereby preserving genetic diversity and preventing premature convergence by maintaining a sufficient number of viable perturbations.
}
\end{tcolorbox}
% \vspace{-0.15cm}
% \vspace{-0.05cm}
\subsubsection{Runtime Performance Compared with Others}\label{evaluation:RQ2 performance:runtime}
\hfill \\
\textbf{Setup.}
% To evaluate the attack costs, we tracked the number of adversarial samples generated within 500 minutes on \malscan (Degree) and KNN-1 as the target model where \hrat has the highest ASR.
To assess the performance of the testing, we monitored the number of adversarial samples generated within 500 minutes on \malscan (Degree) and KNN-1 models. These models and features were chosen because the baselines (e.g., \hrat) achieved the highest ASR with them.
\noindent\textbf{Results \& Analysis.}
Figure~\ref{fig:runtime} demonstrates that \tool (orange line) detects more successful attacks than both \bagammo (green line) (i.e., \bagammo-G) and \hrat (blue line).
\hrat's runtime efficiency is notably low because each perturbation requires the computation of gradient information from the FCG and target model. Although \tool and \bagammo efficiently completed most attacks within a short period, exhibiting exceptional runtime efficiency, \bagammo's progress stalls after approximately 110 minutes, indicating premature convergence, likely due to the limited variety in its single operators (i.e., only involve adding edges) and the lack of directional feedback from target models. In contrast, the persistent growth of \tool highlights its ability to continuously explore the huge search space and identify viable solutions.
{For further analysis, we also calculated the average time cost per iteration of mutant generation, with the following results: 0.34s for \bagammo, 18.72s for \hrat, and 0.67s for \tool. \hrat takes significantly longer due to the heavy gradient calculation. Compared to single-objective \bagammo, the selection process in our method is slightly slower. However, our dependency-aware mutation and multi-objective optimization are well worth it, as they ultimately lead to a significant reduction in the overall time cost required to detect adversarial exampless, as shown in Figure~\ref{fig:runtime}.}
% \vspace{-0.15cm}
\begin{tcolorbox}[left=1pt, right=1pt, top=0pt, bottom=0pt]
\label{conclusion:2}
\small
% \hypertarget{}
{\textbf{Answer to RQ2}}:
\textit{
\tool is efficient in generating failure cases (i.e., more failures within the same time), adding fewer perturbations (i.e., lower PR), and maintaining a higher number of valid perturbations (i.e., higher ASGG).
% Successful attacks exhibited relatively low perturbation rates, indicating high attack efficiency. Notable efficiency was demonstrated in solving operator conflicts, thereby ensuring \ssw{diversified sequences to avoid premature convergence. \tool has also better runtime compared to other methods.}
}
\end{tcolorbox}
\vspace{0.35cm}
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\begin{table*}[!t]
\centering
% \caption{Results of Ablation Studies on the Key Components of \tool.
\caption{Ablation Studies on the Key Components of \tool.
}
% \vspace{-0.35cm}
\label{tab:rq3_ablation}
\resizebox{.99\textwidth}{!}{
\begin{tabular}{c|ccc|cccc|cccc|ccc|ccc}
\hline
& \multicolumn{3}{c|}{MLP} & \multicolumn{4}{c|}{KNN-1} & \multicolumn{4}{c|}{KNN-3} & \multicolumn{3}{c|}{Random Forest} & \multicolumn{3}{c}{AdaBoost} \\ \cline{2-18}
\multirow{-2}{*}{} & -Cri & -Dep & -Int & -Cri & -Dep & -Int & -Sur & -Cri & -Dep & -Int & -Sur & -ASN & -ADN & -ALE & -ASN & -ADN & -ALE \\ \hline
\rowcolor[HTML]{CFE2F3}
\malscan (Degree) & -0.11 & \ul{-0.08} & -0.12 & -0.12 & \ul{-0.03} & -0.05 & \ul{-0.03} & -0.15 & \ul{-0.09} & -0.14 & -0.16 & -0.01 & \ul{0.00} & \ul{-0.19} & \textbf{-0.19} & 0.02 & -0.56 \\
\malscan (Katz) & \textbf{-0.29} & \textbf{-0.60} & \textbf{-0.56} & \textbf{-0.23} & -0.17 & -0.11 & -0.11 & \textbf{-0.23} & \textbf{-0.50} & -0.12 & -0.19 & -0.05 & -0.13 & -0.38 & -0.01 & -0.28 & -0.48 \\
\rowcolor[HTML]{CFE2F3}
\malscan (Harmonic) & -0.10 & \ul{-0.08} & -0.07 & -0.18 & -0.17 & -0.18 & -0.13 & -0.18 & -0.13 & -0.15 & \textbf{-0.25} & -0.01 & \ul{0.00} & -0.41 & \ul{0.00} & -0.01 & -0.60 \\
\malscan (Closeness) & -0.16 & -0.21 & -0.08 & -0.18 & -0.18 & -0.16 & -0.21 & -0.17 & -0.13 & -0.13 & -0.15 & -0.01 & -0.02 & -0.35 & -0.06 & -0.03 & -0.25 \\
\rowcolor[HTML]{CFE2F3}
\malscan (Average) & -0.20 & -0.15 & -0.12 & -0.18 & -0.18 & -0.18 & \textbf{-0.28} & -0.20 & -0.18 & \textbf{-0.18} & -0.21 & -0.03 & -0.02 & -0.23 & \ul{0.00} & -0.13 & \ul{-0.18} \\
\malscan (Concentrate) & -0.18 & -0.15 & -0.11 & \textbf{-0.23} & \textbf{-0.27} & \textbf{-0.23} & \textbf{-0.28} & -0.14 & -0.11 & -0.09 & -0.16 & \textbf{-0.06} & \textbf{-0.14} & -0.61 & -0.05 & \textbf{-0.50} & -0.58 \\
\rowcolor[HTML]{CFE2F3}
\mamadroid & -0.18 & -0.20 & -0.16 & -0.18 & -0.22 & -0.19 & -0.20 & -0.14 & -0.22 & -0.18 & -0.16 & \ul{0.00} & \ul{0.00} & \textbf{-0.75} & \ul{0.00} & \ul{0.00} & \textbf{-0.78} \\
\apigraph & \ul{-0.04} & -0.13 & \ul{-0.04} & \ul{-0.05} & -0.05 & \ul{-0.03} & \ul{-0.03} & \ul{-0.01} & -0.18 & \ul{-0.03} & \ul{-0.04} & \ul{0.00} & \ul{0.00} & -0.68 & \ul{0.00} & \ul{0.00} & -0.72 \\ \hline
\end{tabular}
}
\vspace{-0.25cm}
\end{table*}
\vspace{-0.55cm}
\begin{figure}[!t]
\vspace{-0.2cm}
\centering
\captionsetup{justification=centering}
% \hspace{0.15\textwidth} % 左边距
\begin{minipage}[b]{0.24\textwidth}
\includegraphics[width=\textwidth]{figure/crossovernew.png}
\caption{Impact of \\ Dependency-aware \\Strategy.}
\label{fig:rq2_survival_genes}
\end{minipage}
\hfill
\begin{minipage}[b]{0.24\textwidth}
\includegraphics[width=\textwidth]{figure/time_jul30.png}
\caption{Runtime Efficiency Comparison with Other State-of-the-Art Methods.}
\label{fig:runtime}
\end{minipage}
% \hspace{0.15\textwidth} % 右边距
% \vspace{-0.25cm}
\end{figure}
% \vspace{0.15cm}
\subsection{RQ3: Ablation Studies}\label{evaluation:RQ3 ablation}
% \vspace{-0.15cm}
\noindent\textbf{Setup.}
To assess the effectiveness of key components in \tool, we quantified the reduction in ASR across 40 target models upon the removal of the specific component. Specifically, key components include critical area identification (\S~\ref{methodology:critical_area_identification}) as $Cri$, dependency-aware strategy (\S~\ref{methodology:individual_representation}) as $Dep$, and fitness function (\S~\ref{methodology:fitness}). Additionally, three new perturbation operators (\S~\ref{sec:perturbation}), including Add Sparse Nodes ($ASN$), Add Dense Nodes ($ADN$), and Add Long Edges ($ALE$), are used mainly for ensemble models (i.e., RF and AB).
% This is because these models exhibit very robust performance with low ASR (\S~\ref{evaluation:RQ1 effectiveness}) in random attack and higher PR (\S~\ref{evaluation:RQ2 performance:perturbation}).
The fitness function for MLP models incorporates interpretation-based scores ($Int$), whereas, for KNN models, it includes additional scores derived from a surrogate model($Sur$). To summarize, the evaluated components for MLP and KNNs include $Cri$, $Dep$, and $Int$, with $Sur$ additionally assessed for KNNs. For ensemble models, we focus on the impact of $ASN$, $ADN$, and $ALE$. The experimental parameters are consistent with those in RQ1 (\S~\ref{evaluation:RQ1 effectiveness}).
\noindent\textbf{Results \& Analysis.}\label{MLP_ablation}
Table~\ref{tab:rq3_ablation} displays the ASR discrepancies resulting from the removal of individual components, compared to the complete configuration in Table~\ref{tab:RQ1_asr}.
First, the removal of certain components results in notable reductions in ASR, emphasizing their critical role in the effectiveness of \tool. For instance, removing $Cri$ and $Dep$ significantly affects the ASR in MalScan (Katz) models more than in other models. The removal of $Cri$ always results in the largest drops, and under the KNN-1 and KNN-3 configurations, the removal of $Dep$ leads to decreases as high as 0.60 and 0.50, respectively.
Due to its inherent robustness, MalScan (Katz) requires substantial perturbations (Table \ref{tab:rq2_perturbation}) and effective dependency management to maintain a viable number of genes in the population (Figure.~\ref{fig:rq2_survival_genes}), which prevents premature convergence of the GA, as noted in \S~\ref{evaluation:RQ2 performance:survival_genes}.
Moreover, the $Sur$ is critical for KNN models, where its removal leads to significant ASR reductions to other components. This suggests that KNN classifiers may rely more heavily on specific interpretations or feature relations that the surrogate model helps to exploit.
Second, certain features and models demonstrate minimal impact from the removal of components.
% For instance, \apigraph shows notably smaller declines in ASR in configurations involving the removal of $Cri$, $Int$, and $Sur$, all below 0.04.
For instance, \apigraph shows notably smaller ASR declines, all below 0.04, when $Cri$, $Int$, and $Sur$ are removed.
This suggests that \apigraph has inherent robustness, as noted in \S~\ref{evaluation:RQ1 effectiveness}.
Its robustness can be attributed to high-level feature abstraction, making it less sensitive to perturbations affecting fewer nodes or less critical connections within the FCG's structure.
Third, the impact of new perturbation operators varies significantly across ensemble models. The removal of $ALE$ demonstrates substantial ASR drops, especially in the \mamadroid and \apigraph models. This is primarily because these models are based on features constructed from the call relationships between functions, making them highly sensitive to substantial changes in edges, particularly those directed toward system functions. Although the node-adding based operators, $ASN$ and $ADN$, aim to reduce the centrality of malicious nodes in \malscan graphs, $ALE$ more significantly disrupts node centrality by altering graph structures, i.e, adding edges that modify path lengths and node connectivity (\S \ref{sec:perturbation}).
This change impacts the graph's overall centrality more drastically than simply adjusting nodes.
% \vspace{-0.15cm}
\begin{tcolorbox}[left=1pt, right=1pt, top=0pt, bottom=0pt]
\label{insight:5}
\small
% \hypertarget{}
{\textbf{Finding \#5}}:
\textit{
%在最鲁棒的模型中，基于边的扰动比基于点的扰动更具有影响力。
Edge-based perturbations tend to be more effective than node-based ones, impacting the most robust models by altering the graph's features significantly.
}
\end{tcolorbox}
% \vspace{-0.25cm}
\begin{tcolorbox}[left=1pt, right=1pt, top=0pt, bottom=0pt]
\label{conclusion:3}
\small
% \hypertarget{}
{\textbf{Answer to RQ3}}:
\textit{
Each component in \tool plays a distinct role in enhancing the ASR for different models. Specifically, $Cri$ and $Dep$ significantly boost ASR in \malscan (Katz), while $Sur$ is crucial for KNN models. In ensemble models, $ALE$ proves to be highly influential.
}
\end{tcolorbox}
\vspace{-0.25cm}
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% \subsection{RQ4: Black-box Evaluation}\label{evaluation:RQ4 adaptability}
% \begin{figure*}[ht!]
% \centering
% \begin{subfigure}[b]{0.24\textwidth}
% \includegraphics[width=\textwidth]{figure/Degree.png}
% \subcaption{MalScan\textsubscript{D}}
% \label{fig:transfer1_malscan_degree}
% \end{subfigure}
% \begin{subfigure}[b]{0.24\textwidth}
% \includegraphics[width=\textwidth]{figure/Katz.png}
% \subcaption{MalScan\textsubscript{K}}
% \label{fig:transfer1_malscan_katz}
% \end{subfigure}
% \begin{subfigure}[b]{0.24\textwidth}
% \includegraphics[width=\textwidth]{figure/Closeness.png}
% \subcaption{MalScan\textsubscript{C}}
% \label{fig:transfer1_malscan_closeness}
% \end{subfigure}
% % \begin{subfigure}[b]{0.24\textwidth}
% % \includegraphics[width=\textwidth]{figure/Harmonic.png}
% % \subcaption{MalScan\textsubscript{H}}
% % \label{fig:transfer1_sub4}
% % \end{subfigure}
% % \begin{subfigure}[b]{0.16\textwidth}
% % \includegraphics[width=\textwidth]{figure/Avg.png}
% % \subcaption{MalScan\textsubscript{AVG}}
% % \label{fig:transfer1_sub5}
% % \end{subfigure}
% \begin{subfigure}[b]{0.24\textwidth}
% \includegraphics[width=\textwidth]{figure/Con.png}
% \subcaption{MalScan\textsubscript{CON}}
% \label{fig:transfer1_malscan_concentrate}
% \end{subfigure}
% \begin{subfigure}[b]{0.32\textwidth}
% \includegraphics[width=\textwidth]{figure/MLP_new_new.png}
% \subcaption{MLP}
% \label{fig:transfer2_MLP}
% \end{subfigure}
% \begin{subfigure}[b]{0.32\textwidth}
% \includegraphics[width=\textwidth]{figure/KNN1_new_new.png}
% \subcaption{KNN-1}
% \label{fig:transfer2_KNN1}
% \end{subfigure}
% \begin{subfigure}[b]{0.32\textwidth}
% \includegraphics[width=\textwidth]{figure/RF_new_new.png}
% \subcaption{Random Forest}
% \label{fig:transfer2_RF}
% \end{subfigure}
% \caption{Transferability in between different features and models}
% \label{fig:transfer}
% \vspace{-0.1cm}
% \end{figure*}
% \begin{figure*}[ht!]
% \centering
% \begin{subfigure}[b]{0.32\textwidth} % Adjusted width to 0.19 of the text width
% \includegraphics[width=\textwidth]{figure/MLP_new_new.png}
% \subcaption{MLP}
% \label{fig:transfer2_sub1}
% \end{subfigure}
% \begin{subfigure}[b]{0.32\textwidth}
% \includegraphics[width=\textwidth]{figure/KNN1_new_new.png}
% \subcaption{KNN-1}
% \label{fig:transfer2_sub2}
% \end{subfigure}
% % \begin{subfigure}[b]{0.19\textwidth}
% % \includegraphics[width=\textwidth]{figure/KNN_3.png}
% % \subcaption{KNN-3}
% % \label{fig:transfer2_sub3}
% % \end{subfigure}
% \begin{subfigure}[b]{0.32\textwidth}
% \includegraphics[width=\textwidth]{figure/RF_new_new.png}
% \subcaption{Random Forest}
% \label{fig:transfer2_sub4}
% \end{subfigure}
% % \begin{subfigure}[b]{0.3\textwidth}
% % \includegraphics[width=\textwidth]{figure/AB_new_new.png}
% % \subcaption{AdaBoost}
% % \label{fig:transfer2_sub5}
% % \end{subfigure}
% \caption{Transferability between different features}
% \label{fig:transfer2}
% \end{figure*}
% \subsubsection{Transferability in Black-box Scenarios}\label{evaluation:RQ4 part1}
% \hfill \\
% \textbf{Setup.}
% We assessed the transferability of adversarial samples across 5 classifiers with a fixed feature type and 8 feature types with a fixed classifier. The adversarial samples used across 40 target models are derived from RQ1 (\S~\ref{evaluation:RQ1 effectiveness}). For convenience, we abbreviate the various feature types of \malscan as follows: Degree as MalScan\textsubscript{D}, Katz as MalScan\textsubscript{K}, Harmonic as MalScan\textsubscript{H}, Closeness as MalScan\textsubscript{C}, Average as MalScan\textsubscript{AVG}, and Concentrate as MalScan\textsubscript{CON}.
% \noindent\textbf{Results \& Analysis.}
% Figure~\ref{fig:transfer} (a-d) and Figure~\ref{fig:transfer_appendix} (a-b) display the transferability of adversarial samples among different models with a fixed feature type, while Figure~\ref{fig:transfer} (e-g) and Figure~\ref{fig:transfer_appendix} (c-d) illustrates the transferability across various features with a fixed classifier. The x-axis represents the target classifiers (e.g, Figure~\ref{fig:transfer} (a)) or features (e.g., Figure~\ref{fig:transfer} (e)) used for generating adversarial samples, while the y-axis shows the target classifiers or features where these samples are tested. Due to the space limits, we put the results regarding other features and classifiers in Appendix (see Figure~\ref{fig:transfer_appendix}).
% Figure~\ref{fig:transfer} (a-d) highlights the variability in transferability across different models.
% Notably, single models (i.e., MLP and KNNs) demonstrate almost zero transferability to ensemble models (i.e., AB and RF), emphasizing the robustness of tree-based classifiers and their unique feature distribution, aligning with the finding from robustness analysis in \S ~\ref{evaluation:RQ1 effectiveness}. This lack of transferability even extends from AB to RF, confirming the distinctiveness of each ensemble model's approach to classification. Conversely, when RF is employed as a surrogate model in AMD methods, it effectively facilitates the transfer of adversarial examples, particularly in single models where ASR often exceeds 90\%, especially with the MalScan\textsubscript{K} and MalScan\textsubscript{D} feature.
% {This demonstrates that the ensemble voting mechanism of RF, which utilizes multiple decision trees, enhances its ability to generalize across diverse unseen adversarial examples, suggesting it could be a better surrogate model.}
% %This illustrates the rich and complex decision structure of RF allows it to generalize better across various unseen adversarial examples, making it a more robust surrogate model in AMD. \fei{rewrite the last sentence. }
% Figure.~\ref{fig:transfer} (e-g) showcases the variability in adaptability among different features, aiding in the identification of the most effective features for use as substitutes in black-box attacks. Most features can easily attack MalScan\textsubscript{H}, MalScan\textsubscript{AVG}, and MalScan\textsubscript{CON}, indicating they are the most vulnerable. Surprisingly, these three features successfully achieve mutual attacks in all models except MLP. This suggests that these features may share similar patterns that can be attacked across various classifiers, except in MLP. Conversely, it is challenging to attack \mamadroid, \apigraph, and MalScan\textsubscript{K} features, which is consistent with the finding from robustness analysis in \S ~\ref{evaluation:RQ1 effectiveness}. However, within the RF model, the MalScan\textsubscript{K} exhibits a relatively lower robustness. The observations suggest a low overlap between features of varying abstraction levels, with more abstract features (e.g., \apigraph) proving to be robust against attacks. MalScan\textsubscript{D} and \apigraph features perform effectively as attack vectors across most classifiers, especially \apigraph, which nearly manages to compromise all other features when used on RF, and MalScan\textsubscript{D} generally exhibits strong transferability on KNN classifiers. This indicates that more abstract features could potentially encapsulate other features, and that the in-degree and out-degree of sensitive system nodes are likely to more directly represent the semantics of malware.
% \vspace{-0.15cm}
% \begin{tcolorbox}[left=1pt, right=1pt, top=0pt, bottom=0pt]
% \label{insight:4}
% \small
% \hypertarget{}
% {\textbf{Finding \#3}}:
% \textit{
% Complex ensemble models like RF excel as surrogate models, while \apigraph and MalScan\textsubscript{D} have demonstrated significant potential as effective substitute features across various classifiers.
% }
% \end{tcolorbox}
% \vspace{-0.45cm}
% \vspace{-0.25cm}
\section{Discussions}
% \vspace{-0.15cm}
% \begin{enumerate}[leftmargin=*]
% \item
\begin{figure}
\centering
\includegraphics[width=0.48\textwidth]{figure/vs_new_new.png}
% \caption{Number of malware and their adversarial samples detected by VirusTotal}
% \vspace{-15pt}
\caption{Detection Score Difference Between Malware and Corresponding Adversarial Samples.}
\label{fig:rq4_virustotal}
\vspace{-10pt} % 调整到你满意的间距，这里使用-10pt作为示例
\end{figure}
\textbf{(1) Evaluation on Real-world AMD.}
% \subsubsection{Robustness in the Real-world}
% \hfill \\
% \textbf{Setup.}
% To understand the capability of \tool in real-world robustness evaluation, we selected VirusTotal~\cite{virustotal}, a leading platform for malware analysis, as our target~\cite{li2023black,sun2023mate,he2023efficient}.
{To explore the robustness issues present in real-world models, we selected VirusTotal~\cite{virustotal}, a leading platform for malware analysis, as our target~\cite{li2023black,sun2023mate,he2023efficient}.}
% Based on the transferability of different features and models, as detailed on our website~\cite{ourwebsite}, we try to evaluate the real-world robustness of malware detectors.
% To achieve this, we selected VirusTotal~\cite{virustotal}, a leading platform for analyzing malware, as our target~\cite{li2023black,sun2023mate,he2023efficient}.
% Detailed experimental setup in our website.
% We randomly selected 10 adversarial samples from each scenario with original detection counts varying from 4 to 45. We analyzed how frequently these samples were detected as malware, and compared their detection scores as malware before and after the attacks.
We randomly selected 10 adversarial samples from each scenario, with original detection scores ranging from 4 to 45, and compared their detection scores before and after our attack.
{Figure~\ref{fig:rq4_virustotal} shows the change in detection scores for the original malware and their adversarial counterparts as analyzed by VirusTotal.}
%
%comparing these changes for the original samples both before and after the attacks.
%
% \noindent\textbf{Results \& Analysis.}
% Figure~\ref{fig:rq4_virustotal} shows the difference in detection scores as analyzed by VirusTotal.
% Each pair of bars represents one feature-classifier combination, with the taller bar (striped fill) for the original malware, and the shorter bar (solid fill) for the adversarial samples. The numbers inside the bars with striped fill represent the rate of change in detected samples, highlighting the proportion of samples bypassing detection engines.
% Notably, the detection scores (i.e., degree of maliciousness) decreased significantly (over 28\%), indicating potential robustness issues in the real-world AMD of several vendors, possibly due to reliance on vulnerable detection algorithms.
{Notably, the detection scores (which indicate the level of maliciousness) dropped significantly (by over 28\%), suggesting potential weak robustness in the real-world AMD systems of several vendors. This drop might be due to these systems relying on detection algorithms that have robustness issues.}
% adversarial samples successfully bypassed some antivirus mechanisms.
% This suggests the robustness issues in the malware detection methods employed by at least one-third of the vendors, possibly due to reliance on outdated or simplistic detection algorithms.
% This indicates potential robustness issues in the real-wolrd AMD of several vendors, possibly due to reliance on outdated or simplistic detection algorithms.
Further analysis shows that the impact of adversarial samples varies across different classifiers.
KNN-3 experiences the greatest impact (average 50\%) from a model perspective, while \apigraph has the greatest impact (average 51\%) from a feature perspective.
This suggests a preference for relatively robust features and models in real-world scenarios, but they still cannot withstand strong adversarial attacks (e.g., \tool).
To further understand why \tool performs effectively in real-world black-box systems (i.e., VirusTotal), we analyzed the transferability across different features and models. For more detailed results, please refer to our website~\cite{ourwebsite}.
% Therefore, we can identify these vulnerabilities to help improve the robustness.
% On average, the effects are 0.38 for MLP, 0.45 for KNN-1, and 0.50 for KNN-3, indicating that AV engines possibly using KNN-like mechanisms based on sample similarity and voting are particularly vulnerable. Furthermore, the impact of adversarial samples increased with the abstraction level of features, where the average impact is 0.38 for \malscan, 0.44 for \mamadroid, and 0.51 for \apigraph, reflecting its preference in real-world setups due to its detailed API-based semantic analysis. According to Finding \#3, \apigraph is considered a relatively robust feature, but it is still vulnerable under \tool's attack. Therefore, this suggests that combining robust features with strong models (e.g., RF), is crucial for enhancing resilience against diverse attacks in real-world scenarios.
% \vspace{-0.15cm}
% \begin{tcolorbox}[left=1pt, right=1pt, top=0pt, bottom=0pt]
% \label{conclusion:4}
% \small
% \hypertarget{}
% {\textbf{Answer to RQ4}}:
% \textit{
% The results demonstrate that the generated adversarial samples exhibit transferability across different models and features. This characteristic is particularly useful for evaluating real-world black-box antivirus engines.
% }
% \end{tcolorbox}
\noindent\textbf{(2) Robustness Enhancement via Retraining.}
% Robustness concerns in machine learning have long been a significant area of study~\cite{sehwag2019analyzing, lee2021machine}.
The experimental results reinforce the need for continued enhancements in AMD robustness.
From the feature perspective, integrating robust features such as MalScan (Katz) and \apigraph to comprehensively represent malware behaviors proves to be a promising approach. This method, akin to merging static and dynamic features, leverages the distinct advantages of each to provide a complete depiction of potential threats~\cite{anupama2022detection}.
From the model perspective, retraining has been a popular strategy to boost ML model robustness~\cite{chen2020explore, mani2021defending, chen2023continuous}.
In supplementary experiments, we retrained models with adversarial examples generated by \tool, which could significantly decrease the ASR (see detailed results on the website~\cite{ourwebsite}).
% Our experimental results further affirm this approach's efficacy, particularly when incorporating adversarial examples generated by \tool (detailed in Appendix~\ref{retrain}).
Additionally, our studies suggest that ensemble models serve as more robust classifiers in FCG-based AMD environments.
% \item
% \textbf{(2)General Surrogate Models for Adversarial Attacks.}
% \textbf{(2) Better Surrogate Models for Black-box Scenarios.}
% Surrogate models serve a crucial role in bridging white-box and black-box environments in adversarial testing~\cite{li2021framework, li2023black}.
% Our evaluation (\S~\ref{evaluation:RQ4 part1}) indicates that integrating \apigraph and MalScan\textsubscript{D} features with ensemble models can create more versatile surrogate models.
% Although complex linear models like GCNs are often preferred for graph data (\cite{li2021adversarial, sun2022adversarial}), their effectiveness in FCG-based detectors is still a subject of debate (\S~\ref{evaluation:RQ1 effectiveness}). This is primarily due to their difficulties in accurately simulating the decision boundaries of ensemble models.
% Consequently, our findings present an opportunity to bridge the gap in surrogate models for black-box scenarios in the future.
% Consequently, our findings offer an opportunity to bridge this gap Surrogate Models in the black-box in the future.
% the need to explore more robust surrogate models for adversarial testing in black-box scenarios remains pressing.
% Moreover, while complex linear models like GCNs are preferred for graph data (\cite{li2021adversarial, sun2022adversarial}), their effectiveness in FCG-based detectors remains debatable (\S~\ref{evaluation:RQ1 effectiveness}). This is largely because they struggle to accurately simulate the decision boundaries of ensemble models.
% Therefore, a more robust surrogate model remains to be explored for adversarial testing in black-box scenarios.
%These models are capable of spanning a broader array of features and scenarios in black-box settings, similar to works in other fields (\cite{li2023adda, mariotti2023beyond}).
% Surrogate models bridge the gap between white-box and black-box environments in adversarial testing.
% Our evaluation (\S~\ref{evaluation:RQ4 part1}), suggests that combining \apigraph and MalScan\textsubscript{D} features with ensemble models holds potential for developing more universal surrogate models applicable across a broader range of features and models in black-box scenarios, similar to works in other fields~\cite{li2023adda,mariotti2023beyond}.
% Although In graph data, a complex linear model, GCN, is favored~\cite{li2021adversarial, sun2022adversarial}, but their effectiveness in FCG-based detectors has been questioned (\S~\ref{evaluation:RQ1 effectiveness}) due to their hard to simulate the decision boundaries of the ensemble models.
%1.替代模型是白盒到黑盒之间gap的
%2.总结我的finding，说明了黑盒的机会
%3.existing model没有的
% \item \textbf{Evaluation Suggestions for Attacks on FCG-based AMD Methods}
% While existing FCG-based adversarial attack studies~\cite{zhang2020enhancing, he2023efficient, gao2024comprehensive} have demonstrated promising results, they often neglect certain robust features and models, such as \malscan and ensemble models. Our comprehensive analyses reveal limitations in these studies when applied to certain detectors. We recommend that future research should thoroughly evaluate or discuss the effectiveness of the proposed attacks across a variety of detectors featuring different models and robust features.
% \item \textbf{High-efficiency Strategies for Ensemble Models.} The perturbation rates for ensemble models were notably high, as demonstrated in our evaluation (\S \ref{evaluation:RQ1 effectiveness}), largely due to the restricted number of modifiable nodes (e.g., user function calls). This observation led us to introduce two new node-based mutation types: ASN and ADN. However, the effectiveness of these mutations remained constrained to specific scenarios. This highlights the potential for further refinement in mutation strategies, particularly through the edge-based perturbation variants, which could enhance the attack effectiveness on ensemble models, as evidenced by our ablation study (\S \ref{evaluation:RQ3 ablation}). Additionally, there is an opportunity to implement interpretation-based feedback on the ensemble models. Such feedback should identify operations that are influential, potentially leading to more effective perturbations.
% \item
% \noindent\textbf{{(3) High-efficiency Strategies for Ensemble Models.}
\noindent\textbf{(3) High-efficiency Strategies for Ensemble Models.}
The perturbation rates for ensemble models were observably high (\S \ref{evaluation:RQ1 effectiveness}), partially due to a limited number of modifiable nodes (i.e., user function calls) in certain malware. This led us to propose the new node-based mutation operators (i.e., ASN and ADN). However, we found that their effectiveness was still limited to specific scenarios. These results indicate that the mutation operators could still be improved, especially by developing edge-based perturbation variants to potentially increase effectiveness on ensemble models, as demonstrated by the success of edge-based ALE in \S \ref{evaluation:RQ3 ablation}.
Moreover, we can also attempt to develop some interpretation-based feedback at the operator level, which is capable of identifying more influential and less frequently altered operations.
% \end{enumerate}
% Robustness issues in ML have long been a focal point of concern~\cite{sehwag2019analyzing, lee2021machine}. Our research shows that enhancing AMD robustness is still necessary. From the feature perspective, we can combine the more robust MalScan\textsubscript{K} and \apigraph to represent malware behaviors. This approach is similar to integrating static and dynamic features, leveraging the unique strengths of each to provide a comprehensive view of potential threats~\cite{anupama2022detection}.
% From the model perspective, retraining is a common method to enhance the robustness of ML models~\cite{chen2020explore, mani2021defending}, and our experiments also demonstrate its usefulness by adding the adversarial examples generated by \tool (see details in the Appendix~\ref{retrain}). Moreover, our findings indicate that ensemble models are more robust classifiers in FCG-based AMD.
% \vspace{-0.25cm}
\section{Threats to Validity}\label{threatstovalidity}
% \vspace{-0.15cm}
% \textbf{(1) Limited Malware Seeds.}\feng{Better not mention HRAT specifically. Overlapped with (3)}
%由于hrat的运行速度非常的慢，因此我们只选择了有限的数据集在实验中，但是为了确保数据有效且具有代表性，我们分别从6年（覆盖最新年份）中均匀的选择seed，并且确保了这些seed的size是不同的，确保多样化。
The selection of the dataset, including the training dataset and the seed malware, poses a threat to validity. We address this threat by adhering to established data selection protocols and collecting a diverse range of APKs from 2018 to 2023. Similarly, to ensure the validity and representativeness of the seed malware, we randomly selected these seeds from the past six years and varied their sizes to maintain diversity.
{To the best of our knowledge, our dataset spans a recent six-year range, providing broader coverage compared to the baselines.}
The selection of models presents another potential threat to validity, as the results may vary in different AMD models. To mitigate it, we have endeavored to include a broad range of categories, incorporating features with various granularity from the FCG and multiple machine learning models with distinct decision mechanisms. To the best of our knowledge, our evaluations are the most comprehensive concerning various FCG-based features and models.
The replication and extension of baselines pose another threat to validity. Notably, significant discrepancies persist between our results and those reported in the original papers. Actually, the reproducibility issues have also been acknowledged by existing works~\cite{olszewski2023get}. We addressed this threat carefully by: 1) meticulously reviewing the code and consulting with their authors to clarify ambiguous parts; 2) engaging in discussions with the authors about the discrepancies, attributing potential causes to differences in datasets, the APK extraction tools used (e.g., Androguard~\cite{androguard} versus FlowDroid~\cite{flowdroid}), and the models evaluated; 3) releasing our code, models, and seed malware to facilitate verification and replication of our findings~\cite{ourwebsite}.
Finally, employing the interpretation-based method (i.e., SHAP) for interpreting model decisions could pose a threat to validity. SHAP values may not always accurately reflect the influence of different inputs in models. Additionally, alternative interpretation methods could be considered. To mitigate this, we did not rely solely on interpretation scores; instead, the model's output served as the primary and dominant feedback. Our extensive evaluation also demonstrates the overall usefulness of this approach. In future work, we plan to explore the impact of various interpretation methods on \tool.
% can be sensitive to the choice of background dataset and the specific implementation used. To mitigate this, we select a diversified dataset from the training set. When the direction of SHAP differs from the model's output, we prioritize the model's score according to our \textit{Dominance} strategy (in \S \ref{fitness_mlp}). However, SHAP values may still lack accuracy in certain scenarios, particularly with highly complex models.
% We communicated with the authors of the baselines to ensure accurate reproduction of their code. Despite these efforts, discrepancies remain between our results and theirs. Potential reasons include different APK extraction tools (Androguard~\cite{androguard} vs. FlowDroid~\cite{flowdroid}) and the use of different datasets. Newer datasets with more complex APK implementations may have also affected the outcomes.
% Despite this effort, other specific models and features may still be underrepresented.
% However, they still may not capture the full range of real-world scenarios.
% \textbf{(2) Target Model Selection.}\feng{Is this about if the approach can be adapted to non-FCG-based detectors?In terms of detectors' robustness, used training data (larger scale) could be a threat to the fidelity of robustness evaluation.}
% The target models for this study may not represent all possible models used in AMD. We aimed to cover a broad range of categories, such as features with different granularities from FCG and various ML models with distinct decision mechanisms. Despite this effort, other specific models and features may still be underrepresented.
% \textbf{(3) Baseline Reproduction.}
% We communicated with the authors of the baselines to ensure accurate reproduction of their code. Despite these efforts, discrepancies remain between our results and theirs. Potential reasons include different APK extraction tools (Androguard~\cite{androguard} vs. FlowDroid~\cite{flowdroid}) and the use of different datasets. Newer datasets with more complex APK implementations may have also affected the outcomes.
% \textbf{(4) SHAP's Accuracy.}\feng{Better say SHAP's results may be inaccuracy when XXX on specific corner cases (samples), BUT the fitness function still worked well on our data (initially proving its superiority). Wondering if the effectiveness can be improved by more accurate interpreting methods. (Future work)}
% The use of SHAP for interpreting model decisions introduces its own set of challenges. SHAP values can be sensitive to the choice of background dataset and the specific implementation used. To mitigate this, we select a diversified dataset from the training set. When the direction of SHAP differs from the model's output, we prioritize the model's score according to our \textit{Dominance} strategy (in \S \ref{fitness_mlp}). However, SHAP values may still lack accuracy in certain scenarios, particularly with highly complex models.
% Our current research focuses on the three most commonly used categories within FCG-based AMD methods. To address these gaps, future work could expand the range of detectors considered, further exploring their similarities and differences, and more comprehensively evaluating their robustness.
%正如我们在表1中列出的研究范围，有许多攻击或者评估的工作都忽略了malscan这个非常鲁棒的检测器，然而各种类别的检测器的embedding方法相差很大。目前我们的研究在基于FCG的AMD方法中选择了最常用的三类。未来可以考虑更多异同的检测器。
% As indicated in Table~\ref{tab:baselinescope}, some existing studies~\cite{cai2018towards, pendlebury2019tesseract, zhang2020enhancing, he2023efficient, gao2024comprehensive} overlook \malscan, a notably robust detector, despite significant differences in the embedding methods used by various types of detectors. Currently, our research selects the three most commonly used categories within FCG-based AMD methods. Future work could consider a broader array of detectors to explore their similarities and differences further and evaluate their robustness.
%\textbf{(3) High-efficiency mutation types for ensemble models.}
% \textbf{(3) High-efficiency strategies for ensemble models.}
% The perturbation rates for ensemble models were observably high (\S \ref{evaluation:RQ1 effectiveness}), partially due to a limited number of modifiable nodes (i.e., user function calls) in certain malware. This led us to propose two new node-based mutation types (i.e., ASN and ADN). However, their effectiveness was limited to specific scenarios. These results indicate that our mutation strategies could be improved, especially by developing edge-based perturbation variants to potentially increase effectiveness on ensemble models, as demonstrated by the success of edge-based ALE in \S \ref{evaluation:RQ3 ablation}.
% Moreover, we can also attempt to develop some interpretation-based feedback at the operator level, which are capable of identifying more influential and less frequently altered operations.
%
% \vspace{-0.15cm}
\section{Related Work}
% \vspace{-0.15cm}
% \textbf{Android Malware Detection.}\cs{here}
% ML techniques have gained significant traction in the domain of AMD, leveraging diverse feature extraction methodologies and ML classifiers to determine whether an APK is benign or malicious.
% Early works~\cite{arp2014drebin,avdiienko2015mining,garcia2018lightweight, bai2020unsuccessful, bai2021comparative} focus on string-based detectors, like Drebin~\cite{arp2014drebin}, use one-hot encoding to represent the usage of critical APIs. However, string-based approaches often lack deeper semantic information needed to accurately represent malicious patterns, prompting a shift towards more sophisticated techniques such as code structure representations through graph~\cite{wu2019malscan,onwuzurike2019mamadroid,zhang2020enhancing, gao2024comprehensive}.
% Graph-based detectors, on the other hand, use various metrics to represent the calls of critical APIs, offering improved robustness and efficacy.
% For example, \malscan~\cite{wu2019malscan} represents APK behaviors by the importance of critical nodes (system APIs) from a function-level call graph.
% Related works has primarily focused on various techniques for generating adversarial examples for evaluating their robustness.
%
%
%在String-based上的adversarial attack是非常容易的，由于他们是one-hot编码，利用gradient-based的方法对feature进行修改之后，可以跟code一一对应。而在graph-based上的对抗攻击，存在problem-feature reverse的问题，一些work专注于feature level但是难以保持apk的功能完整性，近期的工作专注于在code level进行探索，并且利用启发式搜索的算法，例如强化学习、遗传算法等。
%
{\textbf{ML-based Android Malware Detection.}
ML techniques have gained significant traction in the domain of Android malware detection, leveraging diverse feature extraction and embedding methodologies, such as string-based~\cite{arp2014drebin,garcia2018lightweight}, image-based~\cite{xiao2019image,yuan2020byte}, graph-based~\cite{wu2019malscan,onwuzurike2019mamadroid,zhang2020enhancing}.
For instance, Drebin~\cite{arp2014drebin} utilizes static strings such as permissions and API calls extracted from APKs, employing Support Vector Machines (SVM) for classification. Addressing string obfuscation, RevealDroid~\cite{garcia2018lightweight} resorts to byte-code extraction for consistent classification with Drebin.
However, string/image-based approaches often lack semantic information, prompting a shift towards more sophisticated techniques like Function Call Graph (FCG) representations, exemplified by \malscan~\cite{wu2019malscan}. \malscan represents FCG from the smali code as a social network and employs k-nearest neighbors (KNN) as the classifier, offering improved robustness and efficacy.}
{\textbf{Adversarial Attacks for Robustness Evaluation.}
% Related works~\cite{pierazzi2020intriguing,chen2019android,li2020adversarial,zhao2021structural,he2023efficient,li2023black} in the field of adversarial attacks on ML/DL-based AMD methods has primarily focused on various techniques for generating adversarial examples and evaluating their effectiveness.
% For instance, APG~\cite{pierazzi2020intriguing} employs gradient-based searches, while Android HIV~\cite{chen2019android} targets logits layers using algorithms like C\&W. Recent advances have shifted towards attacks from the problem space by maintaining the semantic integrity of samples, thereby preserving their operational viability in practical scenarios~\cite{zhao2021structural,he2023efficient,li2023black}.
% For example, \hrat~\cite{zhao2021structural} propose graph modification rules for reinforcement learning-based attacks against KNN-1, while \bagammo~\cite{li2023black} focus on GA-based attacks when embedding methods are unknown, primarily targeting \mamadroid~\cite{onwuzurike2019mamadroid}. However, these approaches often rely heavily on model gradient information and may not generalize well across different embedding methods or target models.
Related works~\cite{pierazzi2020intriguing,chen2019android,li2020adversarial,zhao2021structural,he2023efficient,li2023black} have primarily focused on various techniques for generating adversarial examples to evaluate the robustness of malware detectors.
Abundant adversarial attacks on string-based detectors are relatively simple and straightforward features using one-hot encoding, like Drebin~\cite{arp2014drebin}.
By using gradient-based methods~\cite{pierazzi2020intriguing, chen2019android, zhang2021shadowdroid} or interpretability-assisted techniques~\cite{severi2021explanation, sun2023mate}, features can be directly modified and mapped back to the code, leading to high attack success rates.
However, adversarial attacks on graph-based detectors face the problem-feature reverse challenge. This work~\cite{chen2019android} focused on the feature level but struggled to maintain the functional integrity of the APK.
Two recent studies have shifted towards exploring code-level attacks, employing heuristic search algorithms~\cite{zhao2021structural, li2023black}.
{
Zhao et al.~\cite{zhao2021structural} exploited gradient information to estimate perturbation locations and directions. However, discrete gradient estimation errors on binary graphs may cause reinforcement learning to proceed in the wrong direction.
Li et al.~\cite{li2023black} utilized single perturbations and scores from a surrogate model to guide the attack process. However, it easily falls into local optima due to the vast perturbation space created by sparse features like \malscan, resulting from a lack of precise feedback and diversified operators.}
Other researchers are exploring more efficient adversarial attack techniques to improve robustness evaluations of AMD methods, such as using interpretation-assisted feedback~\cite{amich2022eg, liu2022explanation, sun2023mate,yu2023airs}. For example,
%他利用可解释性的引导产生对ML模型有意义的对抗例子，寻找有意义的扰动，帮助评估系统的鲁棒性。
Amich et al.~\cite{amich2022eg} leverages SHAP to guide
adversarial example crafting against ML models, seeking meaningful perturbations to aid in assessing the system's robustness.
Sun et al.\cite{sun2023mate} utilize SHAP to guide attacks on string-based detectors, identifying critical API permissions and inserting uncalled functions. Similarly, Yu et al.\cite{yu2023airs} propose step-level interpretability feedback for deep reinforcement learning in security, aiding in identifying critical steps.}
%Inspired by these research efforts, we aim to leverage interpretation-assisted adversarial attacks to evaluate the robustness of FCG-based AMD methods.
{
Compared to these studies, which focus on proposing adversarial attacks, we concentrate on testing the robustness of graph-based malware detectors through adversarial graph/sample generation and providing findings to enhance robustness.
% Specially, our approach uses novel strategies, such as multi-objective feedback, to guide models more effectively for evaluating the robustness of FCG-based AMD methods.
Additionally, our method does not require the model to be differentiable and significantly broadens the range of target features and models.
}
% Recent advances have shifted towards attacks from the problem space by maintaining the semantic integrity of samples, thereby preserving their operational viability in practical scenarios~\cite{zhao2021structural,he2023efficient,li2023black}.
% For example, \hrat~\cite{zhao2021structural} propose graph modification rules for reinforcement learning-based attacks against KNN-1, while \bagammo~\cite{li2023black} focus on GA-based attacks when embedding methods are unknown, primarily targeting \mamadroid~\cite{onwuzurike2019mamadroid}. However, these approaches often rely heavily on model gradient information and may not generalize well across different embedding methods or target models.
% Other researchers are exploring more efficient adversarial attack techniques to improve robustness evaluations of AMD methods, such as using interpretation-assisted feedback~\cite{amich2022eg, liu2022explanation, sun2023mate,yu2023airs}.
% For example, Amich et al.~\cite{amich2022eg} leverages SHAP to guide
% adversarial example crafting against ML models, seeking meaningful perturbations to aid in assessing the system's robustness.
% Sun et al.\cite{sun2023mate} utilize SHAP to guide attacks on string-based detectors, identifying critical API permissions and inserting uncalled functions.
% Similarly, Yu et al.\cite{yu2023airs} propose step-level interpretability feedback for deep reinforcement learning in security, aiding in identifying critical steps.
% \vspace{-0.2cm}
\section{Conclusion}
% \vspace{-0.15cm}
In this paper, we introduce a method to evaluate the robustness of FCG-based AMD systems.
This method incorporates dependency-aware mutation strategies and utilizes innovative interpretation-based fitness functions to effectively guide perturbation optimization within an FCG.
Our experiments demonstrate superior performance across diverse 40 scenarios, and achieve an average attack success rate of 87.9\%, significantly outperforming baseline methods. Furthermore, our findings offer valuable insights for enhancing model robustness in future developments, and we also provide an in-depth discussion on the benefits of adversarial retraining.
% % \vspace{-0.25cm}
% \section{Data Availability}
% % \vspace{-0.15cm}
% The datasets and code used in this study are available in our anonymized repository~\cite{ourcode}.
% Generated by IEEEtran.bst, version: 1.14 (2015/08/26)
\begin{thebibliography}{10}
\providecommand{\url}[1]{#1}
\csname url@samestyle\endcsname
\providecommand{\newblock}{\relax}
\providecommand{\bibinfo}[2]{#2}
\providecommand{\BIBentrySTDinterwordspacing}{\spaceskip=0pt\relax}
\providecommand{\BIBentryALTinterwordstretchfactor}{4}
\providecommand{\BIBentryALTinterwordspacing}{\spaceskip=\fontdimen2\font plus
\BIBentryALTinterwordstretchfactor\fontdimen3\font minus \fontdimen4\font\relax}
\providecommand{\BIBforeignlanguage}[2]{{%
\expandafter\ifx\csname l@#1\endcsname\relax
\typeout{** WARNING: IEEEtran.bst: No hyphenation pattern has been}%
\typeout{** loaded for the language `#1'. Using the pattern for}%
\typeout{** the default language instead.}%
\else
\language=\csname l@#1\endcsname
\fi
#2}}
\providecommand{\BIBdecl}{\relax}
\BIBdecl
\bibitem{chatterjee2018spyware}
R.~Chatterjee, P.~Doerfler, H.~Orgad, S.~Havron, J.~Palmer, D.~Freed, K.~Levy, N.~Dell, D.~McCoy, and T.~Ristenpart, ``The spyware used in intimate partner violence,'' in \emph{2018 IEEE Symposium on Security and Privacy (SP)}.\hskip 1em plus 0.5em minus 0.4em\relax IEEE, 2018, pp. 441--458.
\bibitem{suarez2020eight}
G.~Suarez-Tangil and G.~Stringhini, ``Eight years of rider measurement in the android malware ecosystem,'' \emph{IEEE Transactions on Dependable and Secure Computing}, vol.~19, no.~1, pp. 107--118, 2020.
\bibitem{sun2021mind}
Z.~Sun, R.~Sun, L.~Lu, and A.~Mislove, ``Mind your weight (s): A large-scale study on insufficient machine learning model protection in mobile apps,'' in \emph{30th USENIX security symposium (USENIX)}, 2021, pp. 1955--1972.
\bibitem{arp2014drebin}
D.~Arp, M.~Spreitzenbarth, M.~Hubner, H.~Gascon, K.~Rieck, and C.~Siemens, ``Drebin: Effective and explainable detection of android malware in your pocket.'' in \emph{Network and Distributed System Security Symposium (NDSS)}, vol.~14, 2014, pp. 23--26.
\bibitem{garcia2018lightweight}
J.~Garcia, M.~Hammad, and S.~Malek, ``Lightweight, obfuscation-resilient detection and family identification of android malware,'' \emph{ACM Transactions on Software Engineering and Methodology (TOSEM)}, vol.~26, no.~3, pp. 1--29, 2018.
\bibitem{xiao2019image}
X.~Xiao and S.~Yang, ``An image-inspired and cnn-based android malware detection approach,'' in \emph{2019 34th IEEE/ACM International Conference on Automated Software Engineering (ASE)}.\hskip 1em plus 0.5em minus 0.4em\relax IEEE, 2019, pp. 1259--1261.
\bibitem{yuan2020byte}
B.~Yuan, J.~Wang, D.~Liu, W.~Guo, P.~Wu, and X.~Bao, ``Byte-level malware classification based on markov images and deep learning,'' \emph{Computers \& Security}, vol.~92, p. 101740, 2020.
\bibitem{wu2019malscan}
Y.~Wu, X.~Li, D.~Zou, W.~Yang, X.~Zhang, and H.~Jin, ``Malscan: Fast market-wide mobile malware scanning by social-network centrality analysis,'' in \emph{2019 34th IEEE/ACM International Conference on Automated Software Engineering (ASE)}.\hskip 1em plus 0.5em minus 0.4em\relax IEEE, 2019, pp. 139--150.
\bibitem{onwuzurike2019mamadroid}
L.~Onwuzurike, E.~Mariconti, P.~Andriotis, E.~D. Cristofaro, G.~Ross, and G.~Stringhini, ``Mamadroid: Detecting android malware by building markov chains of behavioral models (extended version),'' \emph{ACM Transactions on Privacy and Security (TOPS)}, vol.~22, no.~2, pp. 1--34, 2019.
\bibitem{zhang2020enhancing}
X.~Zhang, Y.~Zhang, M.~Zhong, D.~Ding, Y.~Cao, Y.~Zhang, M.~Zhang, and M.~Yang, ``Enhancing state-of-the-art classifiers with api semantics to detect evolved android malware,'' in \emph{Proceedings of the 2020 ACM SIGSAC Conference on Computer and Communications Security (CCS)}, 2020, pp. 757--770.
\bibitem{gao2024comprehensive}
C.~Gao, G.~Huang, H.~Li, B.~Wu, Y.~Wu, and W.~Yuan, ``A comprehensive study of learning-based android malware detectors under challenging environments,'' in \emph{Proceedings of the 46th IEEE/ACM International Conference on Software Engineering (ICSE)}, 2024, pp. 1--13.
\bibitem{hou2017hindroid}
S.~Hou, Y.~Ye, Y.~Song, and M.~Abdulhayoglu, ``Hindroid: An intelligent android malware detection system based on structured heterogeneous information network,'' in \emph{Proceedings of the 23rd ACM SIGKDD international conference on knowledge discovery and data mining}, 2017, pp. 1507--1515.
\bibitem{pei2017deepxplore}
K.~Pei, Y.~Cao, J.~Yang, and S.~Jana, ``Deepxplore: Automated whitebox testing of deep learning systems,'' in \emph{proceedings of the 26th Symposium on Operating Systems Principles}, 2017, pp. 1--18.
\bibitem{xie2019deephunter}
X.~Xie, L.~Ma, F.~Juefei-Xu, M.~Xue, H.~Chen, Y.~Liu, J.~Zhao, B.~Li, J.~Yin, and S.~See, ``Deephunter: a coverage-guided fuzz testing framework for deep neural networks,'' in \emph{Proceedings of the 28th ACM SIGSOFT international symposium on software testing and analysis}, 2019, pp. 146--157.
\bibitem{kim2019guiding}
J.~Kim, R.~Feldt, and S.~Yoo, ``Guiding deep learning system testing using surprise adequacy,'' in \emph{2019 IEEE/ACM 41st International Conference on Software Engineering (ICSE)}.\hskip 1em plus 0.5em minus 0.4em\relax IEEE, 2019, pp. 1039--1049.
\bibitem{carlini2017towards}
N.~Carlini and D.~Wagner, ``Towards evaluating the robustness of neural networks,'' in \emph{2017 IEEE Symposium on Security and Privacy (SP)}.\hskip 1em plus 0.5em minus 0.4em\relax IEEE, 2017, pp. 39--57.
\bibitem{wang2021robot}
J.~Wang, J.~Chen, Y.~Sun, X.~Ma, D.~Wang, J.~Sun, and P.~Cheng, ``Robot: Robustness-oriented testing for deep learning systems,'' in \emph{2021 IEEE/ACM 43rd International Conference on Software Engineering (ICSE)}.\hskip 1em plus 0.5em minus 0.4em\relax IEEE, 2021, pp. 300--311.
\bibitem{barbero2022transcending}
F.~Barbero, F.~Pendlebury, F.~Pierazzi, and L.~Cavallaro, ``Transcending transcend: Revisiting malware classification in the presence of concept drift,'' in \emph{2022 IEEE Symposium on Security and Privacy (SP)}.\hskip 1em plus 0.5em minus 0.4em\relax IEEE, 2022, pp. 805--823.
\bibitem{shahpasand2019adversarial}
M.~Shahpasand, L.~Hamey, D.~Vatsalan, and M.~Xue, ``Adversarial attacks on mobile malware detection,'' in \emph{2019 IEEE 1st International Workshop on Artificial Intelligence for Mobile (AI4Mobile)}.\hskip 1em plus 0.5em minus 0.4em\relax IEEE, 2019, pp. 17--20.
\bibitem{chen2019android}
X.~Chen, C.~Li, D.~Wang, S.~Wen, J.~Zhang, S.~Nepal, Y.~Xiang, and K.~Ren, ``Android hiv: A study of repackaging malware for evading machine-learning detection,'' \emph{IEEE Transactions on Information Forensics and Security (TIFS)}, vol.~15, pp. 987--1001, 2019.
\bibitem{sriramanan2020guided}
G.~Sriramanan, S.~Addepalli, A.~Baburaj \emph{et~al.}, ``Guided adversarial attack for evaluating and enhancing adversarial defenses,'' \emph{Advances in Neural Information Processing Systems}, vol.~33, pp. 20\,297--20\,308, 2020.
\bibitem{li2023black}
H.~Li, Z.~Cheng, B.~Wu, L.~Yuan, C.~Gao, W.~Yuan, and X.~Luo, ``Black-box adversarial example attack towards fcg based android malware detection under incomplete feature information,'' in \emph{32nd USENIX Security Symposium (USENIX)}, 2023, pp. 1181--1198.
\bibitem{sun2023mate}
R.~Sun, M.~Xue, G.~Tyson, T.~Dong, S.~Li, S.~Wang, H.~Zhu, S.~Camtepe, and S.~Nepal, ``Mate! are you really aware? an explainability-guided testing framework for robustness of malware detectors,'' in \emph{Proceedings of the 31st ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering (ESEC/FSE)}, 2023, pp. 1573--1585.
\bibitem{chen2020explore}
J.~Chen, D.~Wang, and H.~Chen, ``Explore the transformation space for adversarial images,'' in \emph{Proceedings of the Tenth ACM Conference on Data and Application Security and Privacy}, 2020, pp. 109--120.
\bibitem{mani2021defending}
N.~Mani, M.~Moh, and T.-S. Moh, ``Defending deep learning models against adversarial attacks,'' \emph{International Journal of Software Science and Computational Intelligence (IJSSCI)}, vol.~13, no.~1, pp. 72--89, 2021.
\bibitem{zhou2022adversarial}
Y.~Zhou, X.~Zhang, J.~Shen, T.~Han, T.~Chen, and H.~Gall, ``Adversarial robustness of deep code comment generation,'' \emph{ACM Transactions on Software Engineering and Methodology (TOSEM)}, vol.~31, no.~4, pp. 1--30, 2022.
\bibitem{zhao2021structural}
K.~Zhao, H.~Zhou, Y.~Zhu, X.~Zhan, K.~Zhou, J.~Li, L.~Yu, W.~Yuan, and X.~Luo, ``Structural attack against graph based android malware detection,'' in \emph{Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security (CCS)}, 2021, pp. 3218--3235.
\bibitem{SHAP2017}
S.~M. Lundberg and S.-I. Lee, ``A unified approach to interpreting model predictions,'' in \emph{Proceedings of the 31st International Conference on Neural Information Processing Systems (NIPS)}, 2017, pp. 4768--4777.
\bibitem{ourcode}
\BIBentryALTinterwordspacing
Open-source dataset and code of this paper. [Online]. Available: \url{https://anonymous.4open.science/r/FCGHUNTER/}
\BIBentrySTDinterwordspacing
\bibitem{yuan2019lightweight}
W.~Yuan, Y.~Jiang, H.~Li, and M.~Cai, ``A lightweight on-device detection method for android malware,'' \emph{IEEE Transactions on Systems, Man, and Cybernetics: systems}, vol.~51, no.~9, pp. 5600--5611, 2019.
\bibitem{li2021backdoor}
C.~Li, X.~Chen, D.~Wang, S.~Wen, M.~E. Ahmed, S.~Camtepe, and Y.~Xiang, ``Backdoor attack on machine learning based android malware detectors,'' \emph{IEEE Transactions on Dependable and Secure Computing}, vol.~19, no.~5, pp. 3357--3370, 2021.
\bibitem{he2023efficient}
P.~He, Y.~Xia, X.~Zhang, and S.~Ji, ``Efficient query-based attack against ml-based android malware detection under zero knowledge setting,'' in \emph{Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security (CCS)}, 2023, pp. 90--104.
\bibitem{kakavand2018application}
M.~Kakavand, M.~Dabbagh, and A.~Dehghantanha, ``Application of machine learning algorithms for android malware detection,'' in \emph{Proceedings of the 2018 International Conference on Computational Intelligence and Intelligent Systems}, 2018, pp. 32--36.
\bibitem{danielsson1980euclidean}
P.-E. Danielsson, ``Euclidean distance mapping,'' \emph{Computer Graphics and image processing}, vol.~14, no.~3, pp. 227--248, 1980.
\bibitem{ourwebsite}
\BIBentryALTinterwordspacing
More details about this paper. [Online]. Available: \url{https://sites.google.com/view/fcghunter}
\BIBentrySTDinterwordspacing
\bibitem{tok2006efficient}
T.~B. Tok, S.~Z. Guyer, and C.~Lin, ``Efficient flow-sensitive interprocedural data-flow analysis in the presence of pointers,'' in \emph{Proceedings of the 15th International Conference on Compiler Construction (CC)}.\hskip 1em plus 0.5em minus 0.4em\relax Springer, 2006, pp. 17--31.
\bibitem{ma2021graph}
Y.~Ma, S.~Wang, T.~Derr, L.~Wu, and J.~Tang, ``Graph adversarial attack via rewiring,'' in \emph{Proceedings of the 27th ACM SIGKDD Conference on Knowledge Discovery \& Data Mining (KDD)}, 2021, pp. 1161--1169.
\bibitem{song2015decision}
Y.-Y. Song and L.~Ying, ``Decision tree methods: applications for classification and prediction,'' \emph{Shanghai archives of psychiatry}, vol.~27, no.~2, p. 130, 2015.
\bibitem{androzoo}
\BIBentryALTinterwordspacing
Androzoo. [Online]. Available: \url{https://androzoo.uni.lu/}
\BIBentrySTDinterwordspacing
\bibitem{virustotal}
\BIBentryALTinterwordspacing
Virustotal. [Online]. Available: \url{https://www.virustotal.com}
\BIBentrySTDinterwordspacing
\bibitem{virusShare}
\BIBentryALTinterwordspacing
Virusshare. [Online]. Available: \url{https://www.virusshare.com}
\BIBentrySTDinterwordspacing
\bibitem{grosse2017adversarial}
K.~Grosse, N.~Papernot, P.~Manoharan, M.~Backes, and P.~McDaniel, ``Adversarial examples for malware detection,'' in \emph{Proceedings of the 22nd European Symposium on Research in Computer Security (ESORICS)}.\hskip 1em plus 0.5em minus 0.4em\relax Springer, 2017, pp. 62--79.
\bibitem{fix1952discriminatory}
E.~Fix and J.~L. Hodges, ``Discriminatory analysis: Nonparametric discrimination: Small sample performance,'' 1952.
\bibitem{breiman2001random}
L.~Breiman, ``Random forests,'' \emph{Machine learning}, vol.~45, pp. 5--32, 2001.
\bibitem{dai2018adversarial}
H.~Dai, H.~Li, T.~Tian, X.~Huang, L.~Wang, J.~Zhu, and L.~Song, ``Adversarial attack on graph structured data,'' in \emph{International conference on machine learning}.\hskip 1em plus 0.5em minus 0.4em\relax PMLR, 2018, pp. 1115--1124.
\bibitem{hratcode}
\BIBentryALTinterwordspacing
Hrat's code. [Online]. Available: \url{https://sites.google.com/view/hrat}
\BIBentrySTDinterwordspacing
\bibitem{alzantot2019genattack}
M.~Alzantot, Y.~Sharma, S.~Chakraborty, H.~Zhang, C.-J. Hsieh, and M.~B. Srivastava, ``Genattack: Practical black-box attacks with gradient-free optimization,'' in \emph{Proceedings of the genetic and evolutionary computation conference}, 2019, pp. 1111--1119.
\bibitem{chen2020frank}
J.~Chen, D.~Zhou, J.~Yi, and Q.~Gu, ``A frank-wolfe framework for efficient and effective adversarial attacks,'' in \emph{Proceedings of the AAAI conference on artificial intelligence}, vol.~34, no.~04, 2020, pp. 3486--3494.
\bibitem{olszewski2023get}
D.~Olszewski, A.~Lu, C.~Stillman, K.~Warren, C.~Kitroser, A.~Pascual, D.~Ukirde, K.~Butler, and P.~Traynor, ``" get in researchers; we're measuring reproducibility": A reproducibility study of machine learning papers in tier 1 security conferences,'' in \emph{Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security (CCS)}, 2023, pp. 3433--3459.
\bibitem{squillero2016divergence}
G.~Squillero and A.~Tonda, ``Divergence of character and premature convergence: A survey of methodologies for promoting diversity in evolutionary optimization,'' \emph{Information Sciences}, vol. 329, pp. 782--799, 2016.
\bibitem{anupama2022detection}
M.~Anupama, P.~Vinod, C.~A. Visaggio, M.~Arya, J.~Philomina, R.~Raphael, A.~Pinhero, K.~Ajith, and P.~Mathiyalagan, ``Detection and robustness evaluation of android malware classifiers,'' \emph{Journal of Computer Virology and Hacking Techniques}, vol.~18, no.~3, pp. 147--170, 2022.
\bibitem{chen2023continuous}
Y.~Chen, Z.~Ding, and D.~Wagner, ``Continuous learning for android malware detection,'' in \emph{32nd USENIX Security Symposium (USENIX)}, 2023, pp. 1127--1144.
\bibitem{androguard}
\BIBentryALTinterwordspacing
Androguard. [Online]. Available: \url{https://github.com/androguard/androguard}
\BIBentrySTDinterwordspacing
\bibitem{flowdroid}
\BIBentryALTinterwordspacing
Flowdroid. [Online]. Available: \url{https://github.com/secure-software-engineering/FlowDroid}
\BIBentrySTDinterwordspacing
\bibitem{pierazzi2020intriguing}
F.~Pierazzi, F.~Pendlebury, J.~Cortellazzi, and L.~Cavallaro, ``Intriguing properties of adversarial ml attacks in the problem space,'' in \emph{2020 IEEE symposium on security and privacy (SP)}.\hskip 1em plus 0.5em minus 0.4em\relax IEEE, 2020, pp. 1332--1349.
\bibitem{li2020adversarial}
D.~Li and Q.~Li, ``Adversarial deep ensemble: Evasion attacks and defenses for malware detection,'' \emph{IEEE Transactions on Information Forensics and Security (TIFS)}, vol.~15, pp. 3886--3900, 2020.
\bibitem{zhang2021shadowdroid}
J.~Zhang, C.~Zhang, X.~Liu, Y.~Wang, W.~Diao, and S.~Guo, ``Shadowdroid: practical black-box attack against ml-based android malware detection,'' in \emph{2021 IEEE 27th International Conference on Parallel and Distributed Systems (ICPADS)}.\hskip 1em plus 0.5em minus 0.4em\relax IEEE, 2021, pp. 629--636.
\bibitem{severi2021explanation}
G.~Severi, J.~Meyer, S.~Coull, and A.~Oprea, ``Explanation-guided backdoor poisoning attacks against malware classifiers,'' in \emph{30th USENIX security symposium (USENIX)}, 2021, pp. 1487--1504.
\bibitem{amich2022eg}
A.~Amich and B.~Eshete, ``Eg-booster: explanation-guided booster of ml evasion attacks,'' in \emph{Proceedings of the Twelfth ACM Conference on Data and Application Security and Privacy}, 2022, pp. 16--28.
\bibitem{liu2022explanation}
M.~Liu, X.~Liu, A.~Yan, Y.~Qi, and W.~Li, ``Explanation-guided minimum adversarial attack,'' in \emph{International Conference on Machine Learning for Cyber Security}.\hskip 1em plus 0.5em minus 0.4em\relax Springer, 2022, pp. 257--270.
\bibitem{yu2023airs}
J.~Yu, W.~Guo, Q.~Qin, G.~Wang, T.~Wang, and X.~Xing, ``$\{$AIRS$\}$: Explanation for deep reinforcement learning based security applications,'' in \emph{32nd USENIX Security Symposium (USENIX Security 23)}, 2023, pp. 7375--7392.
\end{thebibliography}