# HAWK: Rapid Android Malware Detection through Heterogeneous Graph Attention Networks

arXiv: https://arxiv.org/abs/2108.07548 · HTML: https://mlsanity.com/paper/2108.07548/

## Key facts

- Cited by 9 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 17 Aug 2021.

## Built on by (most cited first, 9 of 9)

- [Comprehensive Graph Gradual Pruning for Sparse Training in Graph Neural Networks](https://mlsanity.com/paper/2207.08629/) (2022)
- [RoSGAS: Adaptive Social Bot Detection with Reinforced Self-Supervised GNN Architecture Search](https://mlsanity.com/paper/2206.06757/) (2022)
- [A Survey on Malware Detection with Graph Representation Learning](https://mlsanity.com/paper/2303.16004/) (2023)
- [Recent Advances in Malware Detection: Graph Learning and Explainability](https://mlsanity.com/paper/2502.10556/) (2025)
- [Time-aware Hyperbolic Graph Attention Network for Session-based Recommendation](https://mlsanity.com/paper/2301.03780/) (2023)
- [Dual Explanations via Subgraph Matching for Malware Detection](https://mlsanity.com/paper/2504.20904/) (2025)
- [AHEAD: A Triple Attention Based Heterogeneous Graph Anomaly Detection Approach](https://mlsanity.com/paper/2208.08200/) (2022)
- [VOLTRON: Detecting Unknown Malware Using Graph-Based Zero-Shot Learning](https://mlsanity.com/paper/2507.04275/) (2025)
- [Deep Distance Sensitivity Oracles](https://mlsanity.com/paper/2211.02681/) (2022)

## Abstract (arXiv)

Android is undergoing unprecedented malicious threats daily, but the existing methods for malware detection often fail to cope with evolving camouflage in malware. To address this issue, we present HAWK, a new malware detection framework for evolutionary Android applications. We model Android entities and behavioural relationships as a heterogeneous information network (HIN), exploiting its rich semantic metastructures for specifying implicit higher-order relationships. An incremental learning model is created to handle the applications that manifest dynamically, without the need for re-constructing the whole HIN and the subsequent embedding model. The model can pinpoint rapidly the proximity between a new application and existing in-sample applications and aggregate their numerical embeddings under various semantics. Our experiments examine more than 80,860 malicious and 100,375 benign applications developed over a period of seven years, showing that HAWK achieves the highest detection accuracy against baselines and takes only 3.5ms on average to detect an out-of-sample application, with the accelerated training time of 50x faster than the existing approach.