01 / represent
Hierarchical program graphs
Each APK becomes a two-level program representation: CFGs capture within-function execution structure; an FCG captures relationships between functions.
FCG + CFG NDSS 2027 · Research & open-source implementation
Not all functions are equal.
Classifying new Android malware families from just a few examples, by learning which functions carry the strongest family-specific signals.
Structure-aware inferenceFew-shot · 5-way
Functions are not pooled equally.SDL · Adaptive readout
2
learnable parameters in the SDL readout head
3
independent Android malware corpora
1 / 5
labeled examples per family at test time
500
evaluation episodes per configuration
The method
Structure matters. Function importance matters more.
Most functions in an APK are shared utilities or library code. SDL focuses the graph-level representation on functions that distinguish one malware family from another—particularly valuable when labeled examples are scarce.
02 / learn
Contrastive function embeddings
A shared hierarchical GraphSAGE encoder learns representations with instance-level and set-level contrastive pre-training.
Dual contrastive objectives03 / classify
Adaptive weighted readout
A TF-IDF-inspired gate emphasizes family-specific functions using support-set similarity and a program-structural prior, then builds few-shot prototypes.
Interpretable · 2 scalarsFrom APK to novel-family prediction
InputAPK → FCG + CFGProgram structure and features
EncoderGraphSAGE hierarchyFunction-level embeddings
Pre-train + weightContrastive + SDLAdaptive function importance
InferenceNearest prototypeFamily prediction from K examples
SDL / Structurally Driven Learning
w(v) = σ(τ [λₐ · simin(v) + λᵦ · p(v) − simout(v)])
Reward functions that resemble their own family, discount those that resemble many families, and incorporate a verifiable structural prior. Node scores are subsequently normalized within each graph for weighted readout.
One principle, multiple structural priors
SDL-Complexity uses CFG cyclomatic complexity. SDL-Degree uses FCG in-degree, and an ablation tests PageRank. The readout's key advantage comes from nonuniform, family-aware function weighting—not from any one chosen prior.
Semantic similarityStructural priorSoft gating
Evaluation
Consistent gains across independent corpora.
Mean 5-way few-shot classification accuracy on novel families. All compared methods use common family-disjoint evaluation episodes; scores come from Table II of the paper.
SDL-Complexity Self-Attention FAMCF (flat features)Accuracy (%) · 500 episodes; no-overlap, novel-family evaluation
Two-parameter readout
SDL-Complexity achieves 83.00% on HiGraph and 92.30% on MalDroid at 5-shot, exceeding the learned Self-Attention head on both.
A qualified result
SDL leads on most settings, but FAMCF is stronger on MalDroid 1-shot (83.64% versus SDL's 80.79%). Strong flat API features can still be competitive.
Temporal generalization: with pre-2019 HiGraph training data and novel families drawn from a combined 2019–2021 pool, SDL-Complexity achieves 67.82% (1-shot) and 82.53% (5-shot) accuracy. See Table IV in the paper.
Experimental data
Three corpora, family-disjoint splits.
The study retains the subset of samples processable by all baseline pipelines, with disjoint training, validation, and novel-family partitions.
| Corpus | Base | Validation | Novel | Total APKs |
|---|---|---|---|---|
| HiGraph | 50 families | 16 | 18 | 34,006 |
| MalDroid | 15 families | 5 | 5 | 7,676 |
| KronoDroid | 27 families | 8 | 8 | 5,750 |
| Combined | 92 | 29 | 31 | 47,432 |
Final filtered evaluation corpus; family counts and sample counts from Table I of the paper. Each dataset is evaluated independently.
Research release
Code, methodology, and reproduction.
The public repository provides the hierarchical encoder, SDL variants, baselines, datasets' family labels and mappings, scripts, and evaluation tooling.
GitHub · Code
Source repository
Hierarchical GraphSAGE, SDL weighting, baselines, and the end-to-end pipeline.
Open repository ↗ Docs · READMEReproduction guide
Data preparation, installation, training, configuration, and evaluation commands.
Read instructions ↗ Data · LabelsFamily label mappings
Per-corpus labeled samples and malware-family mapping files.
Browse labels ↗ Python · ModelsMethod implementation
Function encoder, episodic heads, pooling comparisons, and analysis tools.
Explore source ↗ Shell · WorkflowsTraining & evaluation
Scripts for full training, model comparisons, and temporal evaluation.
Browse scripts ↗ NDSS 2027 · PaperPublication & citation
Read the paper offline using the bundled PDF, or copy its bibliographic entry.
Go to citation ↓Quick start · terminal
# Prepare local environment git clone https://github.com/calebdeji/not-all-functions-are-equal.git cd not-all-functions-are-equal pip install -r requirements.txt # After obtaining APK datasets and completing README preprocessing bash scripts/run_training.sh bash scripts/run_evaluation.sh
Raw APKs are not included in the repository. The README specifies dataset acquisition, graph extraction, feature generation, and required splits before training.
Citation
Cite the NDSS 2027 paper.
If this code or method supports your research, please cite the associated conference paper.
BibTeX
@inproceedings{ogunwale2027functions,
title = {Not All Functions Are Equal: Adaptive Node
Weighting for Few-Shot Android Malware Family
Classification},
author = {Ogunwale, Pelumi and Hmaiti, Yohan and
LaViola Jr., Joseph J. and Mohaisen, David},
booktitle = {Proceedings of the Network and Distributed
System Security Symposium (NDSS)},
year = {2027},
doi = {10.14722/ndss.2027.233235}
}Not All Functions Are Equal
Adaptive Node Weighting for Few-Shot Android Malware Family Classification
Pelumi Ogunwale, Yohan Hmaiti, Joseph J. LaViola Jr., and David Mohaisen.
PDF is embedded in this single HTML file, so the download also works offline. The DOI may not resolve until the conference publishes its proceedings.