With the rapid growth of mobile applications and their users, the security of mobile applications has increasingly become the primary concern of the users. At present, there are more and more variants of malware based on the Android platform. There is an urgent need for efficient and effective malware detection methods to ensure the security and reliability of the Android app platform. To address these concerns, we present our lightweight solution ISEDroid which is based on the Instruction Sequence Embedding method to detect Android malware. ISEDroid extracts the instruction execution sequences from the Dalvik code fragments of Android apps, which are used to represent all executable and traceable paths of malware during runtime. Then, it transforms the instruction sequence into a low dimensional numerical vector through the embedding method in natural language processing, and then generates the semantic summary of the sample code behaviors using the average pooling algorithm. Finally, by evaluating different machine learning algorithms, adjusting the dimension of embedded vectors, and optimizing various hyperparameters, we ensure that the parameters of the model are all optimal, so as to achieve the best classification performance. A large number of experiments show that the method proposed in this paper can accurately identify Android malware, and achieved an F1 score of 0.952.
