检索结果-内蒙古大学图书馆

GNSTAM: Integrating Graph Networks With Spatial and Temporal Signature Analysis for Enhanced android malware detection

引用

IEEE ACCESS 2025年 13卷 81326-81346页

作者： Sharma, Yogesh Kumar Tomar, Deepak Singh Pateriya, R. K. Solanki, Surendra Maulana Azad Natl Inst Technol Dept Comp Sci & Engn Bhopal 462003 Madhya Pradesh India Manipal Univ Jaipur Dept Artificial Intelligence & Machine Learning Jaipur 303007 Rajasthan India

The sophistication of android malware poses significant threats to user security and privacy. Traditional detection methods struggle with rapid malware evolution and benign application diversity, leading to high false positive rates and limited adaptability. This paper introduces a hybrid methodology leveraging advanced machine learning techniques to enhance accuracy and adaptability in android malware detection. It begins with collecting and preprocessing a comprehensive dataset of benign and malicious applications. An efficient Generative Adversarial Network (GAN) is employed to generate synthetic malware samples, effectively augmenting the dataset and enhancing the diversity of the malware samples under study process. To model the intricate relationships between applications, an efficient Graph Neural Network (GNN) process is utilized. Incorporating transformers, sequences of system and API calls are analyzed, harnessing this ability to discern patterns indicative of malicious activities. Additionally, a one-shot learning model tailored for the detection of new malware variants with minimal examples is introduced, enabling rapid adaptation to emerging threats. Federated learning preserves user privacy by training the model across a distributed network. A reinforcement learning model initiates proactive defenses, identifying optimal actions against malware threats. This methodology advances android malware detection, showing over 5.9% improvement in detection accuracy, 4.5% reduction in false positives, and enhanced adaptability to new malware variants. It ensures enhanced security for android users while preserving privacy. Evaluation results highlight its practical applicability in real-time scenarios.

关键词： malware Machine learning Feature extraction Adaptation models Accuracy Privacy Federated learning Security Graph neural networks Generative adversarial networks android malware detection generative adversarial network graph neural network federated learning one-shot learning

来源：评论

学校读者我要写书评

暂无评论

A Novel Approach for android malware detection Based on Intelligent Computing

引用

Computers, Materials & Continua 2024年第12期81卷 4371-4396页

作者： Manh Vu Minh Cho Do Xuan Faculty of Information Security Posts and Telecommunications Institute of TechnologyHanoi100000Vietnam

Detecting malware on mobile devices using the android operating system has become a critical challenge in the field of cybersecurity,in the context of the rapid increase in the number of malware variants and the frequency of attacks targeting android *** this paper,we propose a novel intelligent computational method to enhance the effectiveness of android malware detection *** proposed method combines two main techniques:(1)constructing a malware behavior profile and(2)extracting features from the malware behavior profile using graph neural ***,to effectively construct an android malware behavior profile,this paper proposes an information enrichment technique for the function call graph of malware files,based on new graph-structured features and semantic features of the malware’s source ***,to extract significant features from the constructed behavior profile,the study proposes using the GraphSAGE graph neural *** this novel intelligent computational method,a variety of significant features of the malware have been effectively represented,synthesized,and *** approach to detecting android malware proposed in this paper is a new study and has not been explored in previous *** experimental results on a dataset of 40,819 android software indicate that the proposed method performs well across all metrics,with particularly impressive accuracy and recall scores of 99.03%and 99.19%,respectively,which outperforms existing state-of-the-art methods.

关键词： android malware detection malware behavior profile function call graph graph neural network graph-structured features semantic features

来源：评论

学校读者我要写书评

暂无评论

A new approach to android malware detection using fuzzy logic-based simulated annealing and feature selection

引用

MULTIMEDIA TOOLS AND APPLICATIONS 2024年第4期83卷 10525-10549页

作者： Seyfari, Yousef Meimandi, Akbar Univ Maragheh Fac Engn Maragheh Iran

The use of smartphones with the android operating system has been high in the last decade, with the transformation of works and services from traditional shape to mechanized and digitally, the percentage of use of smart devices will remain high. In such a situation, malware with malicious purposes will appear among the useful applications that will create insecure conditions for users of smart devices with the android operating system. In this regard, to deal with malware and to improve malware detection, the simulated annealing algorithm has been used in the feature selection stage along with fuzzy logic in the neighbor generation stage to detect android malware through machine learning algorithms. The proposed method has been tested in ten feature sets with 410 samples from the DREBIN dataset, 328 of which are benign apps and the rest are malware. The experimental results of this study show that the best result in feature selection with the proposed method with the KNN classifier and the set of permission features, with the number of features 1908, has been achieved 99.02% in the accuracy criterion. The results of the paper are better than many recent studies results are done.

关键词： android malware detection Adaptive neighborhood Simulated annealing Fuzzy logic Machine learning Feature selection

来源：评论

学校读者我要写书评

暂无评论

Static analysis framework for permission-based dataset generation and android malware detection using machine learning

引用

EURASIP JOURNAL ON INFORMATION SECURITY 2024年第1期2024卷 33页

作者： Pathak, Amarjyoti Kumar, Th. Shanta Barman, Utpal Guwahati Assam Sci & Technol Univ GIMT Gauhati Assam India Girijananda Chowdhury Univ Dept CSE Gauhati Assam India Assam Down Town Univ Fac Comp Technol Gauhati Assam India

Since android is the popular mobile operating system worldwide, malicious attackers seek out android smartphones as targets. The android malware can be identified through a number of established detection techniques. However, the issues presented by modern malware cannot be met by traditional signature or heuristic-based malware detection methods. Previous research suggests that machine-learning classifiers can be utilised to analyse permissions, making it possible to differentiate between malicious and benign applications on the android platform. There exist machine-learning methods that utilise permission-based attributes to build models for the detection of malware on android devices. Nevertheless, the performance of these detection methods is dependent on the raw or feature datasets. android malware research frequently faces a major obstacle due to the lack of adequate and up-to-date raw malware datasets. In this paper, we put forward a systematic approach to generate an android permission-based dataset using static analysis. To create the dataset, we collect recent raw malware samples (APK files) and focus on the reverse engineering approach and permission-based features extraction. We also conduct a thorough feature analysis to determine the important android permissions and present a machine-learning-based android malware detection mechanism. The experimental result of our study demonstrates that with just 48 features, the random forest classifier-based android malware detection model obtains the best accuracy of 97.5%.

关键词： android malware detection Static analysis Permission feature extraction Feature engineering Machine learning

来源：评论

学校读者我要写书评

暂无评论

DeepCatra: Learning flow- and graph-based behaviours for android malware detection

引用

IET INFORMATION SECURITY 2023年第1期17卷 118-130页

作者： Wu, Yafei Shi, Jian Wang, Peicheng Zeng, Dongrui Sun, Cong Xidian Univ Sch Cyber Engn Xian 710071 Peoples R China Palo Alto Networks Santa Clara CA USA

As android malware grows and evolves, deep learning has been introduced into malware detection, resulting in great effectiveness. Recent work is considering hybrid models and multi-view learning. However, they use only simple features, limiting the accuracy of these approaches in practice. This study proposes DeepCatra, a multi-view learning approach for android malware detection, whose model consists of a bidirectional LSTM (BiLSTM) and a graph neural network (GNN) as subnets. The two subnets rely on features extracted from statically computed call traces leading to critical APIs derived from public vulnerabilities. For each android app, DeepCatra first constructs its call graph and computes call traces reaching critical APIs. Then, temporal opcode features used by the BiLSTM subnet are extracted from the call traces, while flow graph features used by the GNN subnet are constructed from all call traces and inter-component communications. We evaluate the effectiveness of DeepCatra by comparing it with several state-of-the-art detection approaches. Experimental results on over 18,000 real-world apps and prevalent malware show that DeepCatra achieves considerable improvement, for example, 2.7%-14.6% on the F1 measure, which demonstrates the feasibility of DeepCatra in practice.

关键词： feature extraction Mobile, ubiquitous and pervasive computing call graph recurrent neural nets android app GNN subnet deep learning learning (artificial intelligence) graph neural networks flow graph features DeepCatra invasive software Neural nets application program interfaces subnets BiLSTM subnet android (operating system) state-of-the-art detection approaches hybrid models critical APIs simple features deep learning (artificial intelligence) graph theory temporal opcode features Data security graph neural network great effectiveness android malware detection mobile computing multiview learning approach Combinatorial mathematics

来源：评论

学校读者我要写书评

暂无评论

MsDroid: Identifying Malicious Snippets for android malware detection

引用

IEEE TRANSACTIONS ON DEPENDABLE AND SECURE COMPUTING 2023年第3期20卷 2025-2039页

作者： He, Yiling Li, Yiping Wu, Lei Yang, Ziqi Ren, Kui Qin, Zhan Zhejiang Univ Dept Comp Sci & Technol Hangzhou 310027 Zhejiang Peoples R China Beijing Univ Posts & Telecommun Sch Cyberspace Secur Beijing 100876 Peoples R China

Machine learning has shown promise for improving the accuracy of android malware detection in the literature. However, it is challenging to (1) stay robust towards real-world scenarios and (2) provide interpretable explanations for experts to analyse. In this article, we propose MsDroid, an android malware detection system that makes decisions by identifying malicious snippets with interpretable explanations. We mimic a common practice of security analysts, i.e., filtering APIs before looking through each method, to focus on local snippets around sensitive APIs instead of the whole program. Each snippet is represented with a graph encoding both code attributes and domain knowledge and then classified by Graph Neural Network (GNN). The local perspective helps the GNN classifier to concentrate on code highly correlated with malicious behaviors, and the information contained in graphs benefit in better understanding of the behaviors. Hence, MsDroid is more robust and interpretable in nature. To identify malicious snippets, we present a semi-supervised learning approach that only requires app labeling. The key insight is that malicious snippets only exist in malwares and appear at least once in a malware. To make malicious snippets less opaque, we design an explanation mechanism to show the importance of control flows and to retrieve similarly implemented snippets from known malwares. A comprehensive comparison with 5 baseline methods is conducted on a dataset of more than 81K apps in 3 real-world scenarios, including zero-day, evolution, and obfuscation. The experimental results show that MsDroid is more robust than state-of-the-art systems in all cases, with 5.37% to 49.52% advantage in F1-score. Besides, we demonstrate that the provided explanations are effective and illustrate how the explanations facilitate malware analysis.

关键词： malware Codes Task analysis Feature extraction Security Semantics Labeling android malware detection graph neural network explainable machine learning static code analysis

来源：评论

学校读者我要写书评

暂无评论

android malware detection method based on graph attention networks and deep fusion of multimodal features

引用

EXPERT SYSTEMS WITH APPLICATIONS 2024年第PartC期237卷

作者： Chen, Shaojie Lang, Bo Liu, Hongyu Chen, Yikai Song, Yucai Beihang Univ State Key Lab Software Dev Environm Beijing 100191 Peoples R China Zhongguancun Lab Beijing Peoples R China

Currently, android malware detection methods always focus on one kind of app feature, such as structural, semantic, or other statistical features. This paper proposes a novel android malware detection method that integrates multiple features of android applications. First, to effectively extract the structural and semantic features, we propose a new type of call graph named the class-set call graph (CSCG) that uses the sets of Java classes as nodes and the call relationships between class sets as edges, and we design a dynamic adaptive CSCG construction method that can automatically determine the node size for applications with different scales. The topic model is used to mine the source code semantics from the class sets as the node features. Then, we use a graph attention network (GAT) with max pooling to extract the CSCG feature that encompass both the semantic and structural features of the android application. Furthermore, we construct a deep multimodal feature fusion network to fuse the CSCG features with permission features. Experimental results show that our method achieves a detection accuracy of 97.28%-99.54% on the three constructed datasets, which is better than the existing methods.

关键词： android malware detection Topic model Class -set call graph Graph attention networks Multimodal feature fusion

来源：评论

学校读者我要写书评

暂无评论

An effective deep learning scheme for android malware detection leveraging performance metrics and computational resources

引用

INTELLIGENT DECISION TECHNOLOGIES-NETHERLANDS 2024年第1期18卷 33-55页

作者： Wajahat, Ahsan He, Jingsha Zhu, Nafei Mahmood, Tariq Nazir, Ahsan Ullah, Faheem Qureshi, Sirajuddin Osman, Musa Beijing Univ Technol Fac Informat Technol Beijing Peoples R China Lasbela Univ Agr Water & Marine Sci Dept Comp Sci Lasebla Pakistan CCIS Prince Sultan Univ Artificial Intelligence & Data Analyt AIDA Lab Riyadh Saudi Arabia Univ Educ Fac Informat Sci Vehari Pakistan

With the rise in the use of android smartphones, there has been a proportional surge in the proliferation of malicious applications (apps). As mobile phone users are at a heightened risk of data theft, detecting malware on android devices has emerged as a pressing concern within the realm of cybersecurity. Conventional techniques, such as signature-based routines, are no longer sufficient to safeguard users from the continually evolving sophistication and swift behavioral modifications of novel varieties of android malware. Hence, there has been a significant drive in recent times towards leveraging machine learning (ML) models and methodologies to identify and generalize malicious behavioral patterns of mobile apps for detecting malware. This paper proposes Deep learning (DL) based on new and highly reliable classifier, deep neural decision forest (DNDF) for detecting android malware. Two datasets were used: Drebin and 2014 for comparison with previous studies, and TUANDROMD collected in 2021 for detecting the latest threats with advanced obfuscation and morphing techniques. We have also calculated the time-consuming and computational resources taken by our classifier. After conducting a thorough performance evaluation, our proposed approach attained impressive results on two datasets. The empirical findings reveal that the proposed DBN and DNDF models demonstrated exceptional performance, achieving an accuracy of 99%, a sensitivity of 1, and an AUC value of 0.98%. The metrics we obtained are comparable to those of state-of-the-art ML-based android malware detection techniques and several commercial antivirus engines.

关键词： android malware detection deep learning auto-encoder deep belief neural network deep neural decision forest

来源：评论

学校读者我要写书评

暂无评论

Comprehensive android malware detection Based on Federated Learning Architecture

引用

IEEE TRANSACTIONS ON INFORMATION FORENSICS AND SECURITY 2023年 18卷 3977-3990页

作者： Fang, Wenbo He, Junjiang Li, Wenshan Lan, Xiaolong Chen, Yang Li, Tao Huang, Jiwu Zhang, Linlin Sichuan Univ Sch Cyber Sci & Engn Chengdu 610065 Peoples R China Shenzhen Univ Guangdong Key Lab Intelligent Informat Proc Shenzhen 518060 Peoples R China Shenzhen Univ Shenzhen Key Lab Media Secur Shenzhen 518060 Peoples R China Shenzhen Inst Artificial Intelligence & Robot Soc Shenzhen 518129 Peoples R China Xinjiang Univ Sch Software Urumqi 830046 Peoples R China

android malware and its variants are a major challenge for mobile platforms. However, there are two main problems in the existing detection methods: a) The detection method lacks the evolution ability for android malware, which leads to the low detection rate of the detection model for malware and its variants. b) Traditional detection methods require centralized data for model training, however, the aggregation of training samples is limited due to the infectivity of malware and growing data privacy concerns, centralized detection methods are difficult to be applied in actual detection scenarios. In this paper, we propose FEDriod, a comprehensive android malware detection method based on federated learning architecture that protects against growing android malware or emerging android malware variants. Specifically, we employ genetic evolution strategy to simulate the evolution of android malware and develop potential malware variants from typical android malware. Then, we customize the android malware detection model based on residual neural network to achieve high detection accuracy. Finally, to achieve the protection sensitive data, we develope a federated learning framework to allows multiple android malware detection agencies to jointly build a comprehensive android malware detection model. We comprehensively evaluate the performance of FEDriod on the CIC, Drebin, and Contagio authoritative datasets. Experimental results show that our local model outperforms all baseline classifiers. In the federal scenario, our proposed method is superior to the state-of-the-art detection methods, especially in the cross-dataset evaluation, the F1 of FEDriod is 98.53%. More important, we performed genetic evolution experiments on the Drebin dataset, and the results showed that our proposed method has the ability to detect android malware variants.

关键词： Genetic evolution residual networks federated learning android malware detection

来源：评论

学校读者我要写书评

暂无评论

android malware detection: Investigating the impact of imbalanced data-sets on the performance of machine learning models. 24

Android malware detection: Investigating the impact of imbal...

引用

24th International Conference on Advanced Communication Technology (ICACT) - Artificial Intelligence Technologies toward Cybersecurity

作者： Sawadogo, Zakaria Mendy, Gervais Dembele, Jean Marie Ouya, Samuel Univ Cheikh Anta Diop Dakar LITA Lab Informat Telecommun & Applicat Dakar Senegal Univ Gaston Berger LANI Lab Anal Numer & Informat Dakar Senegal

ISBN: (纸本)9791188428090

Artificial intelligence has revolutionized many areas of research, including research on malicious application detection and classification. Nowadays, there are many approaches that learn from existing data and predict the classes of new data. Machine learning principles recommend a balance of classes in the training dataset, but the reality in the field is quite different. The majority of datasets used for malicious application detection are imbalanced. Class imbalance degrades classifier performance, so it is a common problem in classification tasks. This observation is much more significant in the area of android malware detection and classification. There are few works to our knowledge on the effects of imbalanced datasets in the field of android malware detection. Our contribution focuses on the impact of imbalanced datasets on the performance of different algorithms and the suitability of using evaluation metrics in android malware detection. We show that for malicious application detection, some classification algorithms are not suitable for unbalanced datasets. We also proved that some of the most used in literature performance evaluation metrics (Accuracy, Precision, Recall) are not very well adapted to imbalanced datasets. On the other hand, the metrics (Balanced accuracy, Geometric mean) are more adapted. These results were obtained by evaluating the performances of eleven classification algorithms and also the adequacy of the different evaluation metrics (Accuracy, Recall, Precision, F1 score, Balanced accuracy, Matthews corrcoef, Geometric mean, Fowlkes mallows).

关键词： imbalanced dataset android malware detection malware classification Artificial intelligence Machine learning

来源：评论

学校读者我要写书评

暂无评论

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案：

请选择收藏分类：

通借通还

建议与咨询 留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案： 新增检索档案 确定 取消

请选择收藏分类： 新增自定义分类 确定 取消

通借通还

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

请选择保存的检索档案：

请选择收藏分类：