检索结果-内蒙古大学图书馆

Securing android IoT devices with GuardDroid transparent and lightweight malware detection

AIN SHAMS ENGINEERING JOURNAL 2024年第5期15卷

作者： Wajahat, Ahsan He, Jingsha Zhu, Nafei Mahmood, Tariq Nazir, Ahsan Ullah, Faheem Qureshi, Sirajuddin Dev, Soumyabrata Beijing Univ Technol Fac Informat Technol Beijing 100124 Peoples R China Lasbela Univ Agr Water & Marine Sci Dept Comp Sci Lasbela 80700 Pakistan CCIS Prince Sultan Univ Artificial Intelligence & Data Analyt AIDA Lab Riyadh 11586 Saudi Arabia Univ Educ Fac Informat Sci Vehari Campus Vehari 61100 Pakistan Univ Coll Dublin Sch Comp Sci Dublin D04 V1W8 Ireland

The Internet of Things (IoT) has experienced significant growth in recent years and has emerged as a very dynamic sector in the worldwide market. Being an open -source platform with a substantial user base, android has not only been a driving force in the swift advancement of the IoT but has also garnered attention from malicious actors, leading to malware attacks. Given the rapid proliferation of android malware in recent times, there is an urgent requirement to introduce practical techniques for the detection of such malware. While current machine learning -based android malware detection approaches have shown promising results, the majority of these methods demand extensive time and effort from malware analysts to construct dynamic or static features. Consequently, the practical application of these methods becomes challenging. Therefore, this paper presents an android malware detection system characterized by its lightweight design and reliance on explainable machine -learning techniques. The system uses features extracted from mobile applications (apps) to distinguish between malicious and benign apps. Through extensive testing, it has exhibited exceptional accuracy and an F1 -score surpassing 0.99 while utilizing minimal device resources and presenting negligible false positive and false negative rates. Furthermore, the classifier model's transparency and comprehensibility are significantly augmented through the application of Shapley's additive explanation scores, enhancing the overall interpretability of the system.

关键词： android malware detection Machine learning RFE SHAP IoT Random forest

来源：评论

学校读者我要写书评

暂无评论

Analysis of Bayesian classification-based approaches for android malware detection

引用

IET INFORMATION SECURITY 2014年第1期8卷 25-36页

作者： Yerima, Suleiman Y. Sezer, Sakir McWilliams, Gavin Queens Univ Belfast CSIT Belfast Antrim North Ireland

Mobile malware has been growing in scale and complexity spurred by the unabated uptake of smartphones worldwide. android is fast becoming the most popular mobile platform resulting in sharp increase in malware targeting the platform. Additionally, android malware is evolving rapidly to evade detection by traditional signature-based scanning. Despite current detection measures in place, timely discovery of new malware is still a critical issue. This calls for novel approaches to mitigate the growing threat of zero-day android malware. Hence, the authors develop and analyse proactive machine-learning approaches based on Bayesian classification aimed at uncovering unknown android malware via static analysis. The study, which is based on a large malware sample set of majority of the existing families, demonstrates detection capabilities with high accuracy. Empirical results and comparative analysis are presented offering useful insight towards development of effective static-analytic Bayesian classification-based solutions for detecting unknown android malware.

关键词： invasive software learning (artificial intelligence) operating system kernels pattern classification smart phones android malware detection mobile malware smartphones signature based scanning machine learning static analysis static analytic Bayesian classification

来源：评论

学校读者我要写书评

暂无评论

ANALYSIS OF FEATURES SELECTION AND MACHINE LEARNING CLASSIFIER IN android malware detection

ANALYSIS OF FEATURES SELECTION AND MACHINE LEARNING CLASSIFI...

引用

5th International Conference on Information Science and Applications (ICISA)

作者： Mas'ud, Mohd Zaki Sahib, Shahrin Abdollah, Mohd Faizal Selamat, Siti Rahayu Yusof, Robiah Univ Teknikal Malaysia Melaka Fac Informat Technol & Commun Durian Tunggal 76100 Melaka Malaysia

ISBN: (纸本)9781479944415

The proliferation of android-based mobile devices and mobile applications in the market has triggered the malware author to make the mobile devices as the next profitable target. With user are now able to use mobile devices for various purposes such as web browsing, ubiquitous services, online banking, social networking, MMS and etc, more credential information is expose to exploitation. Applying a similar security solution that work in Desktop environment to mobile devices may not be proper as mobile devices have a limited storage, memory, CPU and power consumption. Hence, there is a need to develop a mobile malware detection that can provide an effective solution to defence the mobile user from any malicious threat and at the same time address the limitation of mobile devices environment. Prior to this matter, this research focused on evaluating the best features selection to be used in the best machine-learning classifiers. To find the best combination of both features selection and classifier, five sets of different feature selection are applies to five different machine learning classifiers. The classifier outcome is evaluated using the True Positive Rate (TPR), False Positive Rate (FPR), and Accuracy. The best combination of both features selection and classifier can be used to reduce features selection and at the same time able to classify the infected android application accurately.

关键词： Mobile malware android android malware detection Feature Selection Machine Learning

来源：评论

学校读者我要写书评

暂无评论

Mining API Calls and Permissions for android malware detection 13

Mining API Calls and Permissions for Android Malware Detecti...

引用

13th International Conference on Cryptology and Network Security (CANS)

作者： Sharma, Akanksha Dash, Subrat Kumar LNM Inst Informat Technol Dept Comp Sci & Engn Jaipur Rajasthan India

ISBN: (纸本)9783319122809;9783319122793

The popularity of android platform is increasing very sharply due to the large market share of android and openness in nature. The increased popularity is making android an enticing target for malwares. A worrying trend that is alarming is the increasing sophistication of android malware to evade detection by traditional signature based scanners. Several approaches have been proposed in literature for android malware detection. However, most of them are less effective in terms of true positive rate and involves computational overheads. In this paper, we propose an effective approach to attenuate the problem of android malware detection using static code analysis based models. The proposed models, in this paper, are built to capture features relevant to malware behaviour based on API calls as well as permissions present in various android applications. Thereafter, models are evaluated using Naive Bayesian as well as K-Nearest Neighbour classifiers. Proposed models are able to detect real malwares in the wild and achieve an accuracy of 95.1% and true positive rate with highest value one.

关键词： android malware detection API calls Permissions Feature Selection Classification

来源：评论

学校读者我要写书评

暂无评论

android HIV: A Study of Repackaging malware for Evading Machine-Learning detection

引用

IEEE TRANSACTIONS ON INFORMATION FORENSICS AND SECURITY 2020年 15卷 987-1001页

作者： Chen, Xiao Li, Chaoran Wang, Derui Wen, Sheng Zhang, Jun Nepal, Surya Xiang, Yang Ren, Kui Swinburne Univ Technol Fac Sci Engn & Technol Hawthorn Vic 3122 Australia CSIRO Data61 Epping NSW 1710 Australia Univ Buffalo State Univ New York Dept Comp Sci & Engn Buffalo NY 14260 USA

Machine learning-based solutions have been successfully employed for the automatic detection of malware on android. However, machine learning models lack robustness to adversarial examples, which are crafted by adding carefully chosen perturbations to the normal inputs. So far, the adversarial examples can only deceive detectors that rely on syntactic features (e.g., requested permissions, API calls, etc.), and the perturbations can only be implemented by simply modifying application's manifest. While recent android malware detectors rely more on semantic features from Dalvik bytecode rather than manifest, existing attacking/defending methods are no longer effective. In this paper, we introduce a new attacking method that generates adversarial examples of android malware and evades being detected by the current models. To this end, we propose a method of applying optimal perturbations onto android APK that can successfully deceive the machine learning detectors. We develop an automated tool to generate the adversarial examples without human intervention. In contrast to existing works, the adversarial examples crafted by our method can also deceive recent machine learning-based detectors that rely on semantic features such as control-flow-graph. The perturbations can also be implemented directly onto APK's Dalvik bytecode rather than android manifest to evade from recent detectors. We demonstrate our attack on two state-of-the-art android malware detection schemes, MaMaDroid and Drebin. Our results show that the malware detection rates decreased from 96% to 0% in MaMaDroid, and from 97% to 0% in Drebin, with just a small number of codes to be inserted into the APK.

关键词： android malware detection adversarial machine learning

来源：评论

学校读者我要写书评

暂无评论

Sensitivity Analysis of Static Features for android malware detection 22

Sensitivity Analysis of Static Features for Android Malware ...

引用

22nd Iranian Conference on Electrical Engineering (ICEE)

作者： Moghaddam, Samaneh Hosseini Abbaspour, Maghsood Shahid Beheshti Univ Fac Elect & Comp Engn Dept Comp Engn Network Secur LabGC Tehran Iran

ISBN: (纸本)9781479944095

The recent explosion of the number of mobile malware in the wild, significantly increases the importance of developing techniques to detect them. There are many published research in this area which employed traditional desktop malware detection approaches like dynamic and static analysis techniques to detect mobile malwares, but none of them applied a thorough study on the sensitivity analysis of the features used. In this paper we divide static features of classification-based android malware detection techniques proposed in different papers into some related categories and study the influence of using each category of features on the efficiency of classification-based android malware detections technique using all the static features.

关键词： component mobile malware detection static analysis static feature sensitivity analysis android malware detection

来源：评论

学校读者我要写书评

暂无评论

BotDroid: Permission-Based android Botnet detection Using Neural Networks 1

引用

24th International Conference on Engineering Applications of Neural Networks (EANN)

作者： Seraj, Saeed Pimenidis, Elias Pavlidis, Michalis Kapetanakis, Stelios Trovati, Marcello Polatidis, Nikolaos Univ Brighton Sch Architecture Technol & Engn Brighton BN2 4GJ E Sussex England Univ West England Dept Comp Sci & Creat Technol Bristol BS16 1QY Avon England Distributed Analyt Solut 17 Fawe St London 14 6FD England Edge Hill Univ Dept Comp Sci Ormskirk L39 4QP England

ISBN: (数字)9783031342042

ISBN: (纸本)9783031342035;9783031342042

android devices can now offer a wide range of services. They support a variety of applications, including those for banking, business, health, and entertainment. The popularity and functionality of android devices, along with the open-source nature of the android operating system, have made them a prime target for attackers. One of the most dangerous malwares is an android botnet, which an attacker known as a botmaster can remotely control to launch destructive attacks. This paper investigates android botnets by using static analysis to extract features from reverse-engineered applications. Furthermore, this article delivers a new dataset of android apps, including botnet or benign, and an optimized multi-layer perceptron neural network (MLP) for detecting botnets infected by malware based on the permissions of the apps. Experimental results show that the proposed methodology is both practical and effective while outperforming other standard classifiers in various evaluation metrics.

关键词： android malware detection Botnets Neural Networks New dataset

来源：评论

学校读者我要写书评

暂无评论

Deep Convolution Neural Networks for Image-Based android malware Classification

引用

Computers, Materials & Continua 2025年第3期82卷 4093-4116页

作者： Amel Ksibi Mohammed Zakariah Latifah Almuqren Ala Saleh Alluhaidan Department of Information Systems College of Computer and Information SciencesPrincess Nourah bint Abdulrahman UniversityRiyadh11671Saudi Arabia College of Computer and Information Sciences King Saud UniversityRiyadhP.O.Box 11442Saudi Arabia

The analysis of android malware shows that this threat is constantly increasing and is a real threat to mobile devices since traditional approaches,such as signature-based detection,are no longer effective due to the continuously advancing level of *** resolve this problem,efficient and flexible malware detection tools are *** work examines the possibility of employing deep CNNs to detect android malware by transforming network traffic into image data ***,the dataset used in this study is the CIC-AndMal2017,which contains 20,000 instances of network traffic across five distinct malware categories:***,***,***,***,*** network traffic features are then converted to image formats for deep learning,which is applied in a CNN framework,including the VGG16 pre-trained *** addition,our approach yielded high performance,yielding an accuracy of 0.92,accuracy of 99.1%,precision of 98.2%,recall of 99.5%,and F1 score of 98.7%.Subsequent improvements to the classification model through changes within the VGG19 framework improved the classification rate to 99.25%.Through the results obtained,it is clear that CNNs are a very effective way to classify android malware,providing greater accuracy than conventional *** success of this approach also shows the applicability of deep learning in mobile security along with the direction for the future advancement of the real-time detection system and other deeper learning techniques to counter the increasing number of threats emerging in the future.

关键词： android malware detection deep convolutional neural network(DCNN) image processing CIC-AndMal2017 dataset exploratory data analysis VGG16 model

来源：评论

学校读者我要写书评

暂无评论

Hybrid Multilevel detection of Mobile Devices malware Under Concept Drift

引用

JOURNAL OF NETWORK AND SYSTEMS MANAGEMENT 2025年第2期33卷 1-32页

作者： Augello, Andrea De Paola, Alessandra Lo Re, Giuseppe Univ Palermo Dept Engn Palermo Italy

malwares are a major threat to the security of mobile devices, and Machine Learning (ML) is a widespread approach to automatically detect them. However, running ML analysis pipelines can be excessively burdensome for energy-constrained mobile devices. On the other hand, completely off-loading all the analysis to a remote server can introduce unacceptable communication overheads and delays in the detection process. In this paper, we propose a multilevel approach for malware detection on mobile devices that combines a lightweight local analysis of static features with a more computationally expensive remote analysis of dynamic features, through the adoption of ML methods. However, the effectiveness of automatic malware detection systems based on ML is often limited by unforeseen variations in the statistical characteristics of the observed data. This phenomenon, known as concept drift, can lead to a degradation of the performance of ML models over time. The proposed malware detection system is equipped with self-evaluation capabilities, enabling it to detect the occurrence of periods when its predictions become unreliable due to concept drift so that appropriate response strategies can be activated. In particular, when such critical events occur, the self-evaluation agent triggers the execution of an additional layer of analysis, hosted by a remote server, which allows the system to react to the unexpected reduction in its detection capabilities. The computational cost of the detection process is minimized by limiting the remote analysis to only those samples for which the analysis performed on-board the mobile device is likely to incorrectly classify the app.

关键词： android malware detection Mobile security Concept drift Machine learning

来源：评论

学校读者我要写书评

暂无评论

Gupacker: Generalized Unpacking Framework for android malware

引用

IEEE TRANSACTIONS ON INFORMATION FORENSICS AND SECURITY 2025年 20卷 4338-4352页

作者： Zheng, Tao Hou, Qiyu Chen, Xingshu Ren, Hao Li, Meng Li, Hongwei Shen, Changxiang Sichuan Univ Sch Cyber Sci & Engn Chengdu 610065 Peoples R China Sichuan Univ Cyber Sci Res Inst Sch Cyber Sci & Engn Chengdu 610065 Peoples R China Sichuan Univ Key Lab Data Protect & Intelligent Management Minist Educ Chengdu 610065 Peoples R China Hefei Univ Technol Key Lab Knowledge Engn Big Data Sch Comp Sci & Informat Engn Minist Educ Hefei 230002 Peoples R China Hefei Univ Technol Intelligent Interconnected Syst Lab Anhui Prov Hefei 230002 Peoples R China Univ Elect Sci & Technol China Sch Comp Sci & Engn Chengdu 611731 Peoples R China Sichuan Univ Cyber Sci Res Inst Chengdu 610065 Peoples R China

android malware authors often use packers to evade analysis. Although many unpacking tools have been proposed, they face two significant challenges: 1) They are easily impeded by anti-analysis techniques employed by packers, preventing efficient collection of hidden Dex data. 2) They are typically designed to unpack a specific packer and cannot handle malware packed with mixed packers. Consequently, many packed malware samples evade detection. To bridge this gap, we propose Gupacker , a novel generalized unpacking framework. Gupacker offers a generic solution for first-generation holistic packer by customizing the android system source code. It identifies the type of packer and selects an appropriate unpacking function, constructs a deeper active call chain to achieve generic unpacking of second-generation function extraction packers, and uses JNI function and instruction monitoring to handle third-generation virtual obfuscation packer. On this basis, we counteract a diverse array of anti-analysis techniques. We conduct extensive experiments on 5K packed android malware samples, comparing Gupacker with 2 commercial and 4 state-of-the-art academic unpacking tools. The results demonstrate that Gupacker significantly improves the efficiency of android malware unpacking with acceptable system overhead. We analyze real packed applications based on Gupacker and found several are second-packed by attackers, including WPS for android, with tens of millions of users. We receive and responsibly report 13 0day vulnerabilities and also assist in the remediation of all vulnerabilities.

关键词： android malware android packer application unpacking android malware detection android malware android packer application unpacking android malware detection

来源：评论

学校读者我要写书评

暂无评论

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案：

请选择收藏分类：

通借通还

建议与咨询 留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案： 新增检索档案 确定 取消

请选择收藏分类： 新增自定义分类 确定 取消

通借通还

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

请选择保存的检索档案：

请选择收藏分类：