An Original Investigation of Heterogeneous Graph Neural Networks for Malware Detection on Android Devices in Nigeria

Android malware targeting Nigerian mobile banking users has increased dramatically, exploiting the high penetration of Android devices for financial transactions, and existing signature-based and ML-based malware detection approaches fail to capture the complex relational structure of modern malware behaviour graphs, motivating investigation of heterogeneous graph neural network approaches. This study conducted an original investigation into heterogeneous graph neural networks for Android malware detection, making contributions to both the model architecture and the malware analysis methodology for Nigerian threat contexts. A novel malware dataset was constructed from 3,200 Android application packages collected from Nigerian APK repositories, Play Store alternative mirrors, and malware exchange platforms, labelled through multi-scanner ensemble analysis using VirusTotal. Dynamic analysis using an instrumented Android emulator extracted API call graphs, inter-process communication traces, and system call sequences, which were fused into a heterogeneous graph representation with four node types (apps, APIs, permissions, system resources) and seven edge types encoding interaction semantics. A novel Heterogeneous Attention Graph Network (HAGN) architecture was designed, using type-specific attention mechanisms to weight contributions from different node and edge types during message passing. HAGN achieved 97.8 percent malware detection accuracy on the Nigerian dataset holdout test set, outperforming homogeneous GNN baselines (94.1 percent) and MaMaDroid (91.4 percent). Zero-day malware variant detection performance (tested on 200 never-before-seen variants) was 89.3 percent, demonstrating strong generalisation. The study constitutes an original contribution to graph-based malware detection methodology and provides the first Android malware dataset reflective of the Nigerian mobile threat landscape.