检索结果-内蒙古大学图书馆

android malware detection: Feature Update Using Incremental Learning Approach: Further Investigation of UFILA 25

Android Malware Detection: Feature Update Using Incremental ...

25th International Conference on Advanced Communication Technology (ICACT) - New Cyber Security Risks for Enterprise Amidst COVID-19 Pandemic

ISBN: (纸本)9791188428106

Several kinds of mobile applications are available on platforms offering various services to users. Both malware and good applications are found in software repositories, which is a major cybersecurity problem. To address this problem, machine learning approaches have been proposed in the literature for the detection of malware in general and malicious android applications in particular. But obfuscation techniques are used by some developers to hide malicious applications, which implies the need to update android malware detection *** the literature few works are focused on updating features. Our contribution is therefore an incremental learning approach capable of detecting android malware by taking into account both static and dynamic features. We propose through the UFILA approach an updated feature set for android malware detection and classification by adding new features. We evaluated 13 classification algorithms and selected the four most effective algorithms to implement our approach. The results obtained by our approach outperform several malware detection approaches in the literature. Our approach allows to detect malicious android applications based on static and dynamic features with feature updating. It also allows to efficiently classify the different classes.

关键词： imbalanced dataset android malware detection malware classification Artificial intelligence Machine learning

来源：评论

学校读者我要写书评

暂无评论

android malware detection: An in-depth investigation of the impact of the use of imbalance datasets on the efficiency of machine learning models 25

Android malware detection: An in-depth investigation of the ...

引用

25th International Conference on Advanced Communication Technology (ICACT) - New Cyber Security Risks for Enterprise Amidst COVID-19 Pandemic

作者： Degrees, Zakaria Sawadogo Dembele, Jean-Marie Degrees, Gervais Mendy Ouya, Samuel Cheikh Anta Diop Univ LITA Lab Comp Sci Telecommun & Applicat Dakar Senegal Gaston Berger Univ LANI Lab Numer Anal & Comp Sci Dakar Senegal Gaston Berger Univ Dakar Senegal Univ Cheikh Anta Diop ESP Polytechn Sch Dakar Senegal Gaston Berger Univ Comp Sci Dakar Senegal

ISBN: (纸本)9791188428106

Machine learning techniques have become an essential part of research into the detection and classification of malicious applications. There are several approaches or algorithms that learn from existing data and predict classes. Machine learning principles recommend a balance of classes in the training dataset, but the reality on the ground is quite different. The majority of datasets used for malicious application detection are unbalanced. Class imbalance degrades classifier performance, so it is a common problem in classification tasks. This observation is much more significant in the field of android malware detection and classification. There is little work to our knowledge on the effects of unbalanced datasets in the field of android malware detection. Our contribution focuses on the impact of unbalanced datasets on the performance of different algorithms and the relevance of using evaluation metrics in android malware detection. And the state of the databases from which researchers typically draw datasets. We show that for malicious application detection, some classification algorithms are not suitable for unbalanced datasets. We also prove that some of the most widely used performance evaluation metrics in the literature (Accuracy, Precision, Recall) are not very well suited to unbalanced datasets. On the other hand, the metrics (Balanced Accuracy, Geometric mean) are more suitable. These results were obtained by evaluating the performances of eleven classification algorithms as well as the adequacy of the different evaluation metrics (Accuracy, Recall, Precision, F1_score, Balanced accuracy, Matthews corrcoef, Geometric mean, Fowlkes_mallows). Also not all databases are accessible by researchers and many of these databases are not updated.

关键词： imbalanced dataset android malware detection malware classification Artificial intelligence Machine learning

来源：评论

学校读者我要写书评

暂无评论

LDCDroid: Learning data drift characteristics for handling the model aging problem in android malware detection

引用

COMPUTERS & SECURITY 2025年 150卷

作者： Liu, Zhen Wang, Ruoyu Peng, Bitao Qiu, Lingyu Gan, Qingqing Wang, Changji Zhang, Wenbin Guangdong Univ Foreign Studies Sch Informat Sci & Technol Guangzhou 510006 Peoples R China South China Univ Technol Informat & Network Engn Res Ctr Guangzhou 510041 Peoples R China Guangdong Engn Res Ctr Data Secur Governance & Pri Guangzhou Peoples R China Guangdong Prov Key Lab Multimodal Big Data Intelli Guangzhou 510041 Peoples R China Florida Int Univ Knight Fdn Sch Comp & Informat Sci Miami FL 11200 USA

The dynamic and evolving nature of malware applications can lead to deteriorating performance in malware detection models, a phenomenon known as the model aging problem. This issue compromises the model's effectiveness in maintaining mobile security. Model retraining have proven effective in enhancing performance on previously unseen applications. However, the substantial need for annotated data remains a significant challenge in acquiring accurate ground truth for model retraining. Therefore, this paper introduces anew method to address the model aging problem in android malware detection(AMD). To alleviate the burden of manual annotation, our approach incorporates pseudo-labeled data into the retraining process. Specifically, we introduce a novel method for evaluating the data drift scores of newly emerged samples by learning their data drift characteristics. These scores guide the usage of pseudo-labeled and true-labeled data for retraining the model. Our method significantly reduces the resources required for annotation while maintaining the efficacy of malware detection. In long-term datasets, we demonstrate the efficacy of our models through a series of experiments. Results indicate that our method enhances the F-score by approximately 26% in predicting unseen malware over a span of nine years.

关键词： android malware detection Model aging Feature extraction Data drift Mobile security

来源：评论

学校读者我要写书评

暂无评论

GBADroid: an android malware detection method based on multi-view feature fusion

引用

JOURNAL OF SUPERCOMPUTING 2025年第3期81卷 1-32页

作者： Meng, Yi Luktarhan, Nurbol Yang, Xiaotong Zhao, Guodong Xinjiang Univ Sch Comp Sci & Technol Urumqi 830046 Xinjiang Peoples R China Xinjiang Univ Sch Software Urumqi 830091 Xinjiang Peoples R China

With the development of mobile internet, the open android operating system has become the most widely used mobile platform globally, leading to a surge in malware that poses serious threats to user device security. Current android malware detection methods mainly rely on a single feature set, making it difficult to comprehensively represent the characteristics of android applications. To address this limitation, this paper proposes an android malware detection method called GBADroid. GBADroid comprehensively characterizes android software by considering multi-view features. Specifically, it first matches against a list of dangerous permissions to identify potential risks and then employs an information gain algorithm and a Bidirectional Gated Recurrent Unit (BiGRU) to extract opcode features. It also constructs a function call graph (FCG) to extract graph features using Graph Sample and Aggregate (GraphSAGE) algorithm. Experimental results show that GBADroid achieves a detection accuracy of 98.73%, demonstrating superior performance compared to existing methods.

关键词： android malware detection Multi-view feature Graph convolutional network BiGRU

来源：评论

学校读者我要写书评

暂无评论

Meta-SonifiedDroid: Metaheuristics for Optimizing Sonified android malware detection

引用

IEEE ACCESS 2024年 12卷 134779-134808页

作者： Tarwireyi, Paul Terzoli, Alfredo Adigun, Matthew O. Univ Zululand Dept Comp Sci ZA-3886 Kwa Dlangezwa South Africa

To mitigate the rising threat of android malware, researchers have been actively looking for mechanisms that will enable rapid and accurate malware detection. Recently, attention has been paid to the use of audio-based features derived through the use of music information retrieval techniques. Since the exploration of these features is still in the early stages, there is a need to continue experimentation, especially with features that have yet to be used for this task. In this paper, we present the results of an ongoing investigation into the use of audio-based features for android malware detection. In addition to extracting new audio-based features, this research aims to find the most discriminative subset of audio-based features through a comparative evaluation of Wrapper-based metaheuristic optimization algorithms on two separate datasets. First, we sonified the android APK datasets, then extracted 191 static audio-based features from the resultant audio datasets. Fourteen different nature-inspired Wrapper-based metaheuristic optimization algorithms were evaluated for feature selection, and the selected features were then used to train the light gradient-boosting machine (LGBM) classification model. Experimental results demonstrate that the proposed approach exhibits high discriminative capabilities that can outperform other state-of-the-art techniques. The best outcome for android malware detection was obtained using features selected by the Genetic Algorithm, which achieved 50.26% feature reduction and an improved classification accuracy of 99.72%.

关键词： Feature extraction malware Metaheuristics Classification algorithms Accuracy Filtering algorithms Machine learning algorithms Sonification androids audio-based features android malware detection feature selection metaheuristic optimization genetic algorithm (GA) nature-inspired algorithms queuing search algorithm (QSA)

来源：评论

学校读者我要写书评

暂无评论

Sensitive Behavioral Chain-Focused android malware detection Fused With AST Semantics

引用

IEEE TRANSACTIONS ON INFORMATION FORENSICS AND SECURITY 2024年 19卷 9216-9229页

作者： Gong, Jiacheng Niu, Weina Li, Song Zhang, Mingxue Zhang, Xiaosong Univ Elect Sci & Technol China Sch Comp Sci & Engn Chengdu 611731 Peoples R China Univ Elect Sci & Technol China Inst Adv Study Shenzhen 518110 Peoples R China Univ Elect Sci & Technol China Sch Comp Sci & Engn Chengdu 611731 Peoples R China Zhejiang Univ State Key Lab Blockchain & Data Secur Hangzhou 310058 Peoples R China

The proliferation of android malware poses a substantial security threat to mobile devices. Thus, achieving efficient and accurate malware detection and malware family identification is crucial for safeguarding users' individual property and privacy. Graph-based approaches have demonstrated remarkable detection performance in the realm of intelligent android malware detection methods. This is attributed to the robust representation capabilities of graphs and the rich semantic information. The function call graph (FCG) is the most widely used graph in intelligent android malware detection. However, existing FCG-based malware detection methods face challenges, such as the enormous computational and storage costs of modeling large graphs. Additionally, the ignorance of code semantics also makes them susceptible to structured attacks. In this paper, we proposed AndroAnalyzer, which embeds abstract syntax tree (AST) code semantics while focusing on sensitive behavior chains. It leverages FCGs to represent the macroscopic behavior of the application, and employs structured code semantics to represent the microscopic behavior of functions. Furthermore, we proposed the sensitive function call graph (SFCG) generation algorithm to narrow down the analysis scope to sensitive function calls, and the AST vectorization algorithm (AST2Vec) to capture structured code semantics. Experimental results demonstrate that the proposed SFCG generation algorithm noticeably reduces graph size while ensuring robust detection performance. AndroAnalyzer outperforms the baseline methods in binary and multiclass classification tasks, achieving F1-scores of 99.21% and 98.45% respectively. Moreover, AndroAnalyzer (trained with samples of 2010-2018) exhibits good generalization capabilities in detecting samples of 2019-2022.

关键词： malware Semantics Feature extraction Codes Operating systems Vectors Costs Social networking (online) Computational modeling Syntactics android malware detection function call graph abstract syntax tree code semantic embedding graph neural networks

来源：评论

学校读者我要写书评

暂无评论

GSEDroid: GNN-based android malware detection framework using lightweight semantic embedding

引用

COMPUTERS & SECURITY 2024年 140卷

作者： Gu, Jintao Zhu, Hongliang Han, Zewei Li, Xiangyu Zhao, Jianjin Beijing Univ Posts & Telecommun Sch Cyberspace Secur Beijing Peoples R China

Currently, the prevalence of android malware remains substantial. Malicious programs increasingly use advanced obfuscation techniques, posing challenges for security professionals with enhanced disguises, a proliferation of variants, and escalating detection difficulty. Leveraging semantic features presents a promising avenue to address these challenges. Rich semantic information encapsulated within opcodes and API call graphs has been identified as crucial in distinguishing benign from malicious applications. Consequently, various Natural Language Processing (NLP) technologies, such as Word2vec, are employed to encode features of Dalvik opcode sequences, thereby yielding embedded representations. Given that malware developers often opt for semantically similar APIs to achieve comparable functionalities, it is posited that the opcode embeddings for such APIs should exhibit similar characteristics. However, simple NLP models that only extract statistical information are insufficient for understanding obfuscated malware's behavioral patterns, as they do not provide comprehensive semantic insights. To bridge this gap, we propose a novel, lightweight embedding model based on CodeBERT and TextCNN. This model aims for efficient and precise representation of opcode sequences. Consequently, we introduce GSEDroid, an android malware detection framework that uses an API call graph with permission and opcode semantic features to characterize APKs. This approach converts the detection challenge into a graph classification task executed via a graph neural network algorithm. The efficacy of our method has been validated through comparative analyses with other techniques. Experimental results demonstrate that our GraphSage+SAGPooling model achieved an accuracy of 99.47% and an F1 -score of 99.44%, underscoring its effectiveness in android malware detection.

关键词： android malware detection Graph neural network API call graph Dalvik opcode embedding CodeBERT TextCNN

来源：评论

学校读者我要写书评

暂无评论

SNDGCN: Robust android malware detection based on subgraph network and denoising GCN network

引用

EXPERT SYSTEMS WITH APPLICATIONS 2024年 250卷

作者： Lu, Xiaofeng Zhao, Jinglun Zhu, Senhao Lio, Pietro Beijing Univ Post & Telecommun Natl Engn Ctr Mobile Internet Secur Technol Beijing Peoples R China Beijing Univ Post & Telecommun Sch Cyberspace Secur Beijing Peoples R China Univ Cambridge Comp Lab Cambridge CB3 0FD Cambs England

android malware seriously affects the use of android applications, and a growing number of android malware developers are using adversarial attacks to evade detection by deep learning models. This work proposes an android malware detection model based on the android function call graph (FCG) and the denoising graph convolutional network (GCN) that is resistant to adversarial attacks. Methods are also proposed to simplify the FCG to reduce its size, and to construct vertex feature vectors. Because attackers may employ adversarial attack methods, the proposed model uses the subgraph network (SGN) to detect the underlying structural features of the FCG to discover the degree of the obfuscation attack. A denoising graph neural network (GNN) is designed, and the 1-Lipschitz-based neural network denoising method is applied to graph convolution. Moreover, the degree of denoising is adjusted according to the degree of obfuscation, which enhances the robustness of the model. The GCN performs the feature vector extraction of the FCG, and a multilayer perceptron (MLP) is used as the classifier. The results of experiments show that the F 1 value of the proposed android malware detection method is higher than those of other malware detection models for different levels of obfuscation attacks, thus demonstrating its effectiveness against such attacks.

关键词： android malware detection Call graph Graph convolutional neural network Adversarial attack

来源：评论

学校读者我要写书评

暂无评论

PermGuard: A Scalable Framework for android malware detection Using Permission-to-Exploitation Mapping

引用

IEEE ACCESS 2025年 13卷 507-528页

作者： Prasad, Arvind Chandra, Shalini Uddin, Mueen Al-Shehari, Taher Alsadhan, Nasser A. Ullah, Syed Sajid GLA Univ Dept Comp Engn & Applicat Mathura 281406 India BBA Univ Dept Comp Sci Lucknow 226025 India Univ Doha Sci & Technol Coll Comp & Informat Technol Doha Qatar King Saud Univ Dept Self Dev Skill Comp Skills Common First Year Deanship Riyadh 11451 Saudi Arabia King Saud Univ Coll Comp & Informat Sci Comp Sci Dept Riyadh 11451 Saudi Arabia Univ Agder Dept Informat & Commun Technol N-4879 Grimstad Norway

android, the world's most widely used mobile operating system, is increasingly targeted by malware due to its open-source nature, high customizability, and integration with Google services. The increasing reliance on mobile devices significantly raises the risk of malware attacks, especially for non-technical users who often grant permissions without thorough evaluation, leading to potentially devastating effects. This paper introduces PermGuard, a scalable framework for android malware detection that maps permissions into exploitation techniques and employs incremental learning to detect malicious apps. It presents a novel technique for constructing the PermGuard dataset by mapping android permissions to exploitation techniques, providing a comprehensive understanding of how permissions can be misused by malware. The dataset consists of 55,911 benign and 55,911 malware apps, providing a balanced and comprehensive foundation for analysis. Additionally, a new strategy using similarity-based selective training reduces the amount of data required for the training of an incremental learning-based model, focusing on the most relevant data to improve efficiency. To ensure robustness and accuracy, the model adopts a test-then-train approach, initially testing on application data to identify weaknesses and refine the training process. The framework's resilience is tested against adversarial attacks, demonstrating its ability to withstand attempts to bypass or deceive detection mechanisms and enhance overall security. Designed for scalability, PermGuard can handle large and continuously growing datasets, making it suitable for real-world applications. Empirical results indicate that the model achieved an accuracy of 0.9933 on real datasets and 0.9828 on synthetic datasets, demonstrating strong resilience against both real and adversarial attacks.

关键词： malware Operating systems Security Feature extraction Accuracy Internet Training Machine learning Machine learning algorithms Support vector machines android malware detection machine learning permissions exploitation cybersecurity mobile security

来源：评论

学校读者我要写书评

暂无评论

Level Up with ML Vulnerability Identification: Leveraging Domain Constraints in Feature Space for Robust android malware detection

引用

ACM TRANSACTIONS ON PRIVACY AND SECURITY 2025年第2期28卷 1-32页

作者： Bostani, Hamid Zhao, Zhengyu Liu, Zhuoran Moonsamy, Veelasha Radboud Univ Nijmegen Inst Comp & Informat Sci Digital Secur Grp Nijmegen Gelderland Netherlands Xiao Jiaotong Univ Fac Elect & Informat Engn Xian Shaanxi Peoples R China Ruhr Univ Bochum Horst Gortz Inst IT Secur Bochum Nordrhein Westf Germany

Machine Learning (ML) promises to enhance the efficacy of android malware detection (AMD);however, ML models are vulnerable to realistic evasion attacks-crafting realizable Adversarial Examples (AEs) that satisfy android malware domain constraints. To eliminate ML vulnerabilities, defenders aim to identify susceptible regions in the feature space where ML models are prone to deception. The primary approach to identifying vulnerable regions involves investigating realizable AEs, but generating these feasible apps poses a challenge. For instance, previous work has relied on generating either feature-space norm-bounded AEs or problem-space realizable AEs in adversarial hardening. The former is efficient but lacks full coverage of vulnerable regions, whereas the latter can uncover these regions by satisfying domain constraints but is known to be time consuming. To address these limitations, we propose an approach to facilitate the identification of vulnerable regions. Specifically, we introduce a new interpretation of android domain constraints in the feature space, followed by a novel technique that learns them. Our empirical evaluations across various evasion attacks indicate effective detection of AEs using learned domain constraints, with an average of 89.6%. Furthermore, extensive experiments on different android malware detectors demonstrate that utilizing our learned domain constraints in adversarial training outperforms other adversarial training based defenses that rely on norm-bounded AEs or state-of-the-art non-uniform perturbations. Finally, we show that retraining a malware detector with a wide variety of feature-space realizable AEs results in a 77.9% robustness improvement against realizable AEs generated by unknown problem-space transformations, with up to 70x faster training than using problem-space realizable AEs.

关键词： Adversarial machine learning ML vulnerability android malware detection realizable adversarial examples domain constraints feature space

来源：评论

学校读者我要写书评

暂无评论

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案：

请选择收藏分类：

通借通还

建议与咨询 留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案： 新增检索档案 确定 取消

请选择收藏分类： 新增自定义分类 确定 取消

通借通还

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

请选择保存的检索档案：

请选择收藏分类：