检索结果-内蒙古大学图书馆

28th ACM International Conference on Information and Knowledge Management (CIKM)

作者： Hou, Shifu Fan, Yujie Zhang, Yiming Ye, Yanfang Lei, Jingwei Wan, Wenqiang Wang, Jiabin Xiong, Qi Shao, Fudong Case Western Reserve Univ Dept CDS Cleveland OH 44106 USA Tencent Tencent Secur Lab Shenzhen Guangdong Peoples R China

ISBN: (纸本)9781450369763

The explosive growth and increasing sophistication of android malware call for new defensive techniques that are capable of protecting mobile users against novel threats. To combat the evolving android malware attacks, systems of HinDroid and AiDroid have demonstrated the success of heterogeneous graph (HG) based classifiers in android malware detection;however, their success may also incentivize attackers to defeat HG based models to bypass the detection. By far, there has no work on adversarial attack and/or defense on HG data. In this paper, we explore the robustness of HG based model in android malware detection at the first attempt. In particular, based on a generic HG based classifier, (1) we first present a novel yet practical adversarial attack model (named HG-Attack) on HG data by considering android malware attackers' current capabilities and knowledge;(2) to effectively combat the adversarial attacks on HG, we then propose a resilient yet elegant defense paradigm (named Rad-HGC) to enhance robustness of HG based classifier in android malware detection. Promising experimental results based on the large-scale and real sample collections from Tencent Security Lab demonstrate the effectiveness of our developed system alpha Cyber, which integrates our proposed defense model Rad-HGC that is resilient against practical adversarial malware attacks on the HG data performed by HG-Attack.

关键词： android malware detection heterogeneous graph (HG) node classification adversarial attack and defense on HG

来源：评论

学校读者我要写书评

暂无评论

You are what the permissions told me! android malware detection based onhybrid tactics

引用

JOURNAL OF INFORMATION SECURITY AND APPLICATIONS 2022年 66卷

作者： Wang, Huanran Zhang, Weizhe He, Hui Harbin Inst Technol Sch Cyberspace Sci Harbin Peoples R China Peng Cheng Lab Cyberspace Secur Res Ctr Shenzhen Peoples R China

Recent years have witnessed a significant increase in the use of android devices in many aspects of our ***, users can download android apps from third-party channels, which provides numerous opportunitiesfor malware. Attackers utilize unsolicited permissions to gain access to the sensitive private intelligenceof users. Since signature-based antivirus solutions no longer meet practical needs, efficient and adaptablesolutions are desperately needed, especially in new variants. As a remedy, we propose a hybrid androidmalware detection approach that combines dynamic and static tactics. We firstly adopt static analysis inferringdifferent permission usage patterns between malware and benign apps based on the machine-learning-basedmethod. To classify the suspicious apps further, we extract the object reference relationships from the memoryheap to construct a dynamic feature base. We then present an improved state-based algorithm based onDAMBA. Experimental results on a real-world dataset of 21,708 apps show that our approach outperformsthe well-known detector with 97.5% F1-measure. Besides, our system is demonstrated to resist permissionabuse behaviors and obfuscation techniques

关键词： android malware detection Deep learning Permission sequence

来源：评论

学校读者我要写书评

暂无评论

DroidRL: Feature selection for android malware detection with reinforcement learning

引用

COMPUTERS & SECURITY 2023年 128卷

作者： Wu, Yinwei Li, Meijin Zeng, Qi Yang, Tao Wang, Junfeng Fang, Zhiyang Cheng, Luyu Sichuan Univ Coll Software Engn Chengdu Peoples R China Sichuan Univ Sch Cyber Sci & Engn Chengdu Peoples R China Sichuan Univ Coll Comp Sci Chengdu Peoples R China Sichuan Univ Sch Business Chengdu Peoples R China

Due to the completely open-source nature of android, the exploitable vulnerability of malware attacks is increasing. Machine learning, leading to a great evolution in android malware detection in recent years, is typically applied in the classification phase. Since the correlation between features is ignored in some traditional ranking-based feature selection algorithms, applying wrapper-based feature selection models is a topic worth investigating. Though considering the correlation between features, wrapper-based ap-proaches are time-consuming for exploring all possible valid feature subsets when processing a large number of android features. To reduce the computational expense of wrapper-based feature selection, a framework named DroidRL is proposed. The framework deploys DDQN algorithm to obtain a subset of features which can be used for effective malware classification. To select a valid subset of features over a larger range, the exploration-exploitation policy is applied in the model training phase. The recurrent neural network (RNN) is used as the decision network of DDQN to give the framework the ability to sequentially select features. Word embedding is applied for feature representation to enhance the frame-work's ability to find the semantic relevance of features. The framework's feature selection exhibits high performance without any human intervention and can be ported to other feature selection tasks with mi-nor changes. The experiment results show a significant effect when using the Random Forest as DroidRL's classifier, which reaches 95.6% accuracy with only 24 features selected.(c) 2023 Elsevier Ltd. All rights reserved.

关键词： Reinforcement learning android malware detection Feature selection RNN Sequence processing

来源：评论

学校读者我要写书评

暂无评论

An android malware detection Approach to Enhance Node Feature Differences in a Function Call Graph Based on GCNs

引用

SENSORS 2023年第10期23卷 4729-4729页

作者： Wu, Haojie Luktarhan, Nurbol Tian, Gaoqi Song, Yangyang Xinjiang Univ Sch Software Urumqi 830091 Peoples R China Xinjiang Univ Coll Informat Sci & Engn Urumqi 830046 Peoples R China

The smartphone has become an indispensable tool in our daily lives, and the android operating system is widely installed on our smartphones. This makes android smartphones a prime target for malware. In order to address threats posed by malware, many researchers have proposed different malware detection approaches, including using a function call graph (FCG). Although an FCG can capture the complete call-callee semantic relationship of a function, it will be represented as a huge graph structure. The presence of many nonsensical nodes affects the detection efficiency. At the same time, the characteristics of the graph neural networks (GNNs) make the important node features in the FCG tend toward similar nonsensical node features during the propagation process. In our work, we propose an android malware detection approach to enhance node feature differences in an FCG. Firstly, we propose an API-based node feature by which we can visually analyze the behavioral properties of different functions in the app and determine whether their behavior is benign or malicious. Then, we extract the FCG and the features of each function from the decompiled APK file. Next, we calculate the API coefficient inspired by the idea of the TF-IDF algorithm and extract the sensitive function called subgraph (S-FCSG) based on API coefficient ranking. Finally, before feeding the S-FCSG and node features into the GCN model, we add the self-loop for each node of the S-FCSG. A 1-D convolutional neural network and fully connected layers are used for further feature extraction and classification, respectively. The experimental result shows that our approach enhances the node feature differences in an FCG, and the detection accuracy is greater than that of models using other features, suggesting that malware detection based on a graph structure and GNNs has a lot of space for future study.

关键词： android malware detection function call graph TF-IDF self-loop graph convolutional network

来源：评论

学校读者我要写书评

暂无评论

Fuzzy-synthetic minority oversampling technique: Oversampling based on fuzzy set theory for android malware detection in imbalanced datasets

引用

INTERNATIONAL JOURNAL OF DISTRIBUTED SENSOR NETWORKS 2017年第4期13卷 1-15页

作者： Xu, Yanping Wu, Chunhua Zheng, Kangfeng Niu, Xinxin Yang, Yixian Beijing Univ Posts & Telecommun Sch Comp Sci Beijing Peoples R China

In previous work, imbalanced datasets composed of more benign samples (the majority class) than the malicious one (the minority class) have been widely adopted in android malware detection. These imbalanced datasets bias learning toward the majority class, so that the minority class examples are more likely to be misclassified. To solve the problem, we propose a new oversampling method called fuzzy-synthetic minority oversampling technique, which is based on fuzzy set theory and the synthetic minority oversampling technique method. As the sample size of the majority class increases relative to that of the minority class, fuzzy-synthetic minority oversampling technique generates more synthetic examples for each minority class examples in the fuzzy region, where the minority examples have a low degree of membership to the minority class and are more likely to be misclassified. Using the new synthetic examples, the classifiers build larger decision regions that contain more minority examples, and they are no longer biased to the majority class. Compared with synthetic minority oversampling technique and Borderline-synthetic minority oversampling technique methods, fuzzy-synthetic minority oversampling technique achieves higher accuracy on both the minority class and the entire datasets.

关键词： Fuzzy-synthetic minority oversampling technique imbalanced datasets oversample fuzzy region android malware detection

来源：评论

学校读者我要写书评

暂无评论

Permission-based android malware detection System Using Feature Selection with Genetic Algorithm

引用

INTERNATIONAL JOURNAL OF SOFTWARE ENGINEERING AND KNOWLEDGE ENGINEERING 2019年第2期29卷 245-262页

作者： Yildiz, Oktay Dogru, Ibrahim Alper Gazi Univ Fac Engn Dept Comp Engn Ankara Turkey

As the use of smartphones increases, android, as a Linux-based open source mobile operating system (OS), has become the most popular mobile OS in time. Due to the widespread use of android, malware developers mostly target android devices and users. malware detection systems to be developed for android devices are important for this reason. Machine learning methods are being increasingly used for detection and analysis of android malware. This study presents a method for detecting android malware using feature selection with genetic algorithm (GA). Three different classifier methods with different feature subsets that were selected using GA were implemented for detecting and analyzing android malware comparatively. A combination of Support Vector Machines and a GA yielded the best accuracy result of 98.45% with the 16 selected permissions using the dataset of 1740 samples consisting of 1119 malwares and 621 benign samples.

关键词： android malware detection static analysis machine learning support vector machines genetic algorithm feature selection

来源：评论

学校读者我要写书评

暂无评论

SeGDroid: An android malware detection method based on sensitive function call graph learning

引用

EXPERT SYSTEMS WITH APPLICATIONS 2024年 235卷

作者： Liu, Zhen Wang, Ruoyu Japkowicz, Nathalie Gomes, Heitor Murilo Peng, Bitao Zhang, Wenbin Guangdong Univ Foreign Studies Sch Informat Sci & Technol Sch Cyber Secur Guangzhou 510006 Peoples R China South China Univ Technol Informat Network Engn & Res Ctr Guangzhou 510641 Peoples R China Amer Univ Dept Comp Sci Washington DC 20016 USA Victoria Univ Wellington Sch Engn & Comp Sci Wellington 6140 New Zealand Michigan Technol Univ Dept Comp Sci Houghton MI 49931 USA

malware is still a challenging security problem in the android ecosystem, as malware is often obfuscated to evade detection. In such case, semantic behavior feature extraction is crucial for training a robust malware detection model. In this paper, we propose a novel android malware detection method (named SeGDroid) that focuses on learning the semantic knowledge from sensitive function call graphs (FCGs). Specifically, we devise a graph pruning method to build a sensitive FCG on the base of an original FCG. The method preserves the sensitive API (security-related API) call context and removes the irrelevant nodes of FCGs. We propose a node representation method based on word2vec and social-network-based centrality to extract attributes for graph nodes. Our representation aims at extracting the semantic knowledge of the function calls and the structure of graphs. Using this representation, we induce graph embeddings of the sensitive FCGs associated with node attributes using a graph convolutional neural network algorithm. To provide a model explanation, we further propose a method that calculates node importance. This creates a mechanism for understanding malicious behavior. The experimental results show that SeGDroid achieves an F-score of 98% in the case of malware detection on the CICMal2020 dataset and an F-score of 96% in the case of malware family classification on the MalRadar dataset. In addition, the provided model explanation is able to trace the malicious behavior of the android malware.

关键词： android malware detection Function call graph Graph neural network Semantic knowledge Model explanation

来源：评论

学校读者我要写书评

暂无评论

An android malware detection and Classification Approach Based on Contrastive Lerning

引用

COMPUTERS & SECURITY 2022年 123卷

作者： Yang, Shaojie Wang, Yongjun Xu, Haoran Xu, Fangliang Chen, Mantun Natl Univ Def Technol Coll Comp Changsha Peoples R China

android malware detection is a serious issue for mobile security. Recent machine learning-based research could achieve high accuracy. However, there are far more unlabeled samples in the application scenario, while most studies must depend on labeled data for training. This paper proposed, as a solution, a frame-work based on contrastive learning that attempted to reduce the impact of past knowledge and pretrain the model without the participation of labels. The result indicated that the method could reach an ac-curacy above 96% for malware identification on public datasets and above 98% for multiclass detection (malware class and family). In addition, the model could have higher performance than the same super-vised model under the condition of a small proportion of labeled samples. Comparable performance to supervised approaches validated the feasibility of contrastive learning on malware detection by demon-strating its viability. Nonetheless, there are still gaps to be overcome in the future.(c) 2022 Elsevier Ltd. All rights reserved.

关键词： android malware detection malware classification Contrastive learning Feature encoding Feature extraction Deep learning

来源：评论

学校读者我要写书评

暂无评论

Feature Selection to Mine Joint Features from High-dimension Space for android malware detection

引用

KSII TRANSACTIONS ON INTERNET AND INFORMATION SYSTEMS 2017年第9期11卷 4658-4679页

作者： Xu, Yanping Wu, Chunhua Zheng, Kangfeng Niu, Xinxin Lu, Tianling Beijing Univ Posts & Telecommun Sch Cyberspace Secur Beijing 100876 Peoples R China Peoples Publ Secur Univ China Sch Informat Technol & Network Secur Beijing 100038 Peoples R China

android is now the most popular smartphone platform and remains rapid growth. There are huge number of sensitive privacy information stored in android devices. Kinds of methods have been proposed to detect android malicious applications and protect the privacy information. In this work, we focus on extracting the fine-grained features to maximize the information of android malware detection, and selecting the least joint features to minimize the number of features. Firstly, permissions and APIs, not only from android permissions and SDK APIs but also from the developer-defined permissions and third-party library APIs, are extracted as features from the decompiled source codes. Secondly, feature selection methods, including information gain (IG), regularization and particle swarm optimization (PSO) algorithms, are used to analyze and utilize the correlation between the features to eliminate the redundant data, reduce the feature dimension and mine the useful joint features. Furthermore, regularization and PSO are integrated to create a new joint feature mining method. Experiment results show that the joint feature mining method can utilize the advantages of regularization and PSO, and ensure good performance and efficiency for android malware detection.

关键词： android malware detection feature selection joint features particle swarm optimization regularization

来源：评论

学校读者我要写书评

暂无评论

DroidmalwareDetector: A novel android malware detection framework based on convolutional neural network

引用

EXPERT SYSTEMS WITH APPLICATIONS 2022年 206卷

作者： Kabakus, Abdullah Talha Duzce Univ Fac Engn Dept Comp Engn TR-81620 Duzce Turkey Duzce Univ Fac Engn Dept Comp Engn Konuralp Campus TR-81620 Duzce Turkey

Smartphones have become an integral part of our daily lives thanks to numerous reasons. While benefitting from what they offer, it is critical to be aware of the existence of malware in the android ecosystem and be away from them. To this end, an end-to-end and highly effective android malware detection framework based on CNN, namely, DroidmalwareDetector, was proposed within this study. Unlike most of the related work, DroidMalwar-eDetector was specifically designed to (i) automate feature extraction and selection, (ii) propose a novel CNN that operates with 1-dimensional data, and (iii) use intents and API calls alongside the widely used permissions to perform comprehensive malware analysis. The proposed framework was trained and evaluated on the con-structed dataset, which consisted of 14,386 apps from the de-facto standard datasets. The proposed framework's efficiency in terms of distinguishing malware from benign apps was revealed thanks to the conducted experi-ments. According to the experimental result, the accuracy of the proposed framework was calculated as high as 0.9, which was higher than the accuracy values obtained from a wide range of machine learning algorithms. The insights which were gained through the conducted experiments were revealed as another contribution to the research field.

关键词： android android malware detection Deep neural network Convolutional neural network Mobile security

来源：评论

学校读者我要写书评

暂无评论

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案：

请选择收藏分类：

通借通还

建议与咨询 留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案： 新增检索档案 确定 取消

请选择收藏分类： 新增自定义分类 确定 取消

通借通还

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

请选择保存的检索档案：

请选择收藏分类：