Abstract: In the field of Android application security research,a highly effective method within static analysis involves utilizing reverse engineering tools to decompile the application and subsequently extracting the Function Call Graph(FCG) from the decompiled code files,which serves as a primary feature for malware identification.Notably,FCG subgraphs based on sensitive APIs have been widely validated.However,the majority of existing research efforts in this area rely on older sets of sensitive APIs and have not continued to update with the iteration of system APIs.Through experimentation,it has been discovered that when using traditional sensitive API sets to extract feature nodes from the application’s FCG,many cases fail to obtain the desired feature nodes.For instance,with the iterative updates of the Android system,there are significant API adjustments and replacements,or dynamic implicit invocation of system APIs can be achieved using reflection mechanism(Reflect)-related technologies.In response to this,based on the latest comprehensive research framework for Android applications,this paper proposes an Android malware detection method that extracts FCG subgraphs using MOBSF_rule.The method first generates the FCG from the decompiled code files of the application.Then,it utilizes the MOBSF_rule set to extract feature nodes,generating five-node,six-node,and seven-node graphs containing these feature nodes,and statistically analyzing the occurrence frequency of different configuration subgraphs.Finally,the frequency matrix is input into the machine learning method for training and inference.Compared to existing sensitive API sets,the proposed method has the following advantages.1)The MOBSF_rule filtering rule set demonstrates outstanding performance in extracting feature nodes,effectively extracting key API features including reflection mechanisms,component interactions,signature verification,network communication,and client/server(C/S) architecture communication.Compared to traditional sensitive API sets,the effective rate of feature extraction in the latest malware datasets has increased by 69.765%.2)The MOBSF_rule set shows excellent capability in extracting feature nodes across different time tags,exhibiting strong stability.It can not only adapt to the continuous updates of the Android system but also maintain a highly consistent feature extraction capability across different versions.Between 2012 and 2022,compared to traditional sensitive API sets,the overall variance in feature extraction effectiveness over multiple years decreases by 98.747%.3)The method employs the Stacking ensemble learning approach,and compared to the random forest ensemble learning method and the multilayer perceptron method,the accuracy rate has increased by 4.32%.

Key words: Android, Function call graph, Sensitive API, Reflection mechanisms, Ensemble Learning