Android Malware Detection Notes

1. Android covert malware: In particular, a malicious sample is considered as a covert malware must meet the following two conditions: 1) Nodes in the malicious part occupy a small part (e.g., 2%) of all nodes in the entire call graph; and 2) The normal part and the malicious part are highly correlated.

Wu, Y., Zou, D., Yang, W., Li, X., & Jin, H. (2021, July). HomDroid: detecting Android covert malware by social-network homophily analysis. In Proceedings of the 30th ACM SIGSOFT International Symposium on Software Testing and Analysis (pp. 216-229).