检索结果-内蒙古大学图书馆

A Deep Dive Inside DREBIN: An Explorative Analysis beyond android malware detection Scores

ACM TRANSACTIONS ON PRIVACY AND SECURITY 2022年第2期25卷 1–28页

作者： Daoudi, Nadia Allix, Kevin Bissyande, Tegawende Francois Klein, Jacques Univ Luxembourg SnT 29 Ave JF Kennedy L-1359 Luxembourg Luxembourg

Machine learning advances have been extensively explored for implementing large-scale malware detection. When reported in the literature, performance evaluation of machine learning based detectors generally focuses on highlighting the ratio of samples that are correctly or incorrectly classified, overlooking essential questions on why/how the learned models can be demonstrated as reliable. In the android ecosystem, several recent studies have highlighted how evaluation setups can carry biases related to datasets or evaluation methodologies. Nevertheless, there is little work attempting to dissect the produced model to provide some understanding of its intrinsic characteristics. In this work, we fill this gap by performing a comprehensive analysis of a state-of-the-art android malware detector, namely DREBIN, which constitutes today a key reference in the literature. Our study mainly targets an in-depth understanding of the classifier characteristics in terms of (1) which features actually matter among the hundreds of thousands that DREBIN extracts, (2) whether the high scores of the classifier are dependent on the dataset age, and (3) whether DREBIN's explanations are consistent within malware families, among others. Overall, our tentative analysis provides insights into the discriminatory power of the feature set used by DREBIN to detect malware. We expect our findings to bring about a systematisation of knowledge for the community.

关键词： android malware detection machine learning DREBIN SVM

来源：评论

学校读者我要写书评

暂无评论

SDAC: A Slow-Aging Solution for android malware detection Using Semantic Distance Based API Clustering

引用

IEEE TRANSACTIONS ON DEPENDABLE AND SECURE COMPUTING 2022年第2期19卷 1149-1163页

作者： Xu, Jiayun Li, Yingjiu Deng, Robert H. Xu, Ke Singapore Management Univ Sch Informat Syst Singapore 188065 Singapore

A novel slow-aging solution named SDAC is proposed to address the model aging problem in android malware detection, which is due to the lack of adapting to the changes in android specifications during malware detection. Different from periodic retraining of detection models in existing solutions, SDAC evolves effectively by evaluating new APIs' contributions to malware detection according to existing API's contributions. In SDAC, the contributions of APIs are evaluated by their contexts in the API call sequences extracted from android apps. A neural network is applied on the sequences to assign APIs to vectors, among which the differences of API vectors are regarded as the semantic distances. SDAC then clusters all APIs based on their semantic distances to create a feature set in the training phase, and extends the feature set to include all new APIs in the detecting phase. Without being trained by any new set of real-labelled apps, SDAC can adapt to the changes in android specifications by simply identifying new APIs appearing in the detection phase. In extensive experiments with datasets dated from 2011 to 2016, SDAC achieves a significantly higher accuracy and a significantly slower aging speed compared with MaMaDroid, a state-of-the-art android malware detection solution which maintains resilience to API changes.

关键词： malware Testing Training Aging Feature extraction Computational modeling Semantics android malware detection mobile security

来源：评论

学校读者我要写书评

暂无评论

Defensive Randomization Against Adversarial Attacks in Image-based android malware detection

Defensive Randomization Against Adversarial Attacks in Image...

引用

IEEE International Conference on Communications (IEEE ICC)

作者： Lan, Tianwei Darwaish, Asim Nait-Abdesselam, Farid Gu, Pengwenlong Univ Paris Cite Paris France Univ Missouri Kansas City MO 64110 USA Inst Polytech Paris Telecom Paris LTCI Paris France

ISBN: (纸本)9781538674628

The extensive popularity of android operating system hones the increased malware attacks and threatens the android ecosystem. Machine learning is one of the versatile tools to detect legacy and new malware with high accuracy. However, these Machine Learning (ML) models are vulnerable to adversarial attacks, which severely threaten their cybersecurity deployment. To combat the deterrence of ML models against adversarial attacks, we propose a novel randomization method as a defense for image-based detection systems. In addition to defensive randomization, the paper also introduces a novel method, called AutoE, for transforming an APK to an image by leveraging API calls only. To evaluate the effectiveness of randomization as a defense against adversarial settings, we compare our AutoE with two state-of-the-art image-based android malware detection systems. The experimental results reveal that the randomization is a strong defensive hood for image-based android malware detection systems against adversarial attacks. Moreover, our novel AutoE detects malware with 96% accuracy and the randomization approach makes it harder against adversarial attacks.

关键词： Adversarial Attacks and Defense Deep Learning android malware detection Randomization

来源：评论

学校读者我要写书评

暂无评论

android malware detection as a Bi-level problem

引用

COMPUTERS & SECURITY 2022年 121卷

作者： Jerbi, Manel Dagdia, Zaineb Chelly Bechikh, Slim Ben Said, Lamjed Univ Tunis SMART Lab ISG Campus Tunis Tunisia Univ Paris Saclay UVSQ DAVID Gif Sur Yvette France Inst Super Gest Tunis LARODEC Tunis Tunisia

malware detection is still a very challenging topic in the cybersecurity field. This is mainly due to the use of obfuscation techniques. To solve this issue, researchers proposed to extract frequent API (Application Programming Interface) call sequences and then use them as behavior indicators. Several methods aiming at generating malware detection rules have been proposed with the goal to come up with a set of rules that is able to accurately detect malicious code patterns. However, the rules generation process heavily depends on the training database content which will affect the detection rate of the model when confronted to new variants of malicious patterns. In order to assess a rule's detection accuracy, we need to execute the rule on the whole malware database which makes the detection rule quality evaluation very sensitive to the database content. To solve this issue, we suggest in this paper to consider the detection rules generation process as a GLOP (Bi-Level Optimization Problem), where a lower-level optimization task is embedded within the upper-level one. The goal of the upper-level is to generate a set of detection rules in the form of: trees of combined patterns. Those rules are able to detect not only the real patterns from the base of examples but also the artificial patterns generated by the lower-level. The lower-level aims to generate a set of artificial malicious patterns that escape the rules of the upper-level. An efficient co-evolutionary algorithm is adopted as a search engine to ensure optimization at both levels. Such an automated competition between the two levels makes our new method BMD (Bi-level malware detection) able to produce effective detection rules that are capable of detecting new predictable malicious behaviors in addition to existing ones. Based on the statistical analysis of the experimental results, our BMD method has shown its merits when compared to several relevant state-of-the-art malware detection techniques on differ

关键词： android malware detection Bi-level optimization detection rules generation Artificial malicious patterns Evolutionary algorithms

来源：评论

学校读者我要写书评

暂无评论

SeGDroid: An android malware detection method based on sensitive function call graph learning

引用

EXPERT SYSTEMS WITH APPLICATIONS 2024年 235卷

作者： Liu, Zhen Wang, Ruoyu Japkowicz, Nathalie Gomes, Heitor Murilo Peng, Bitao Zhang, Wenbin Guangdong Univ Foreign Studies Sch Informat Sci & Technol Sch Cyber Secur Guangzhou 510006 Peoples R China South China Univ Technol Informat Network Engn & Res Ctr Guangzhou 510641 Peoples R China Amer Univ Dept Comp Sci Washington DC 20016 USA Victoria Univ Wellington Sch Engn & Comp Sci Wellington 6140 New Zealand Michigan Technol Univ Dept Comp Sci Houghton MI 49931 USA

malware is still a challenging security problem in the android ecosystem, as malware is often obfuscated to evade detection. In such case, semantic behavior feature extraction is crucial for training a robust malware detection model. In this paper, we propose a novel android malware detection method (named SeGDroid) that focuses on learning the semantic knowledge from sensitive function call graphs (FCGs). Specifically, we devise a graph pruning method to build a sensitive FCG on the base of an original FCG. The method preserves the sensitive API (security-related API) call context and removes the irrelevant nodes of FCGs. We propose a node representation method based on word2vec and social-network-based centrality to extract attributes for graph nodes. Our representation aims at extracting the semantic knowledge of the function calls and the structure of graphs. Using this representation, we induce graph embeddings of the sensitive FCGs associated with node attributes using a graph convolutional neural network algorithm. To provide a model explanation, we further propose a method that calculates node importance. This creates a mechanism for understanding malicious behavior. The experimental results show that SeGDroid achieves an F-score of 98% in the case of malware detection on the CICMal2020 dataset and an F-score of 96% in the case of malware family classification on the MalRadar dataset. In addition, the provided model explanation is able to trace the malicious behavior of the android malware.

关键词： android malware detection Function call graph Graph neural network Semantic knowledge Model explanation

来源：评论

学校读者我要写书评

暂无评论

Effectiveness of Video-Classification in android malware detection Through API-Streams and CNN-LSTM Autoencoders 5th

Effectiveness of Video-Classification in Android Malware Det...

引用

5th International Symposium on Mobile Internet Security (MobiSec)

作者： D'Angelo, Gianni Palmieri, Francesco Robustelli, Antonio Univ Salerno Dept Comp Sci Fisciano Italy

ISBN: (纸本)9789811695766;9789811695759

The outbreak of the COVID-19 pandemic has forced worldwide employees to massive use of their mobile devices to access corporate systems. This new scenario has made mobile devices more susceptible to malicious applications, which are yearly developed to conduct several hostile activities. Concerned about this fact, many Deep Learning (DL) based solutions have been proposed, in the last decade, by considering both static and dynamic approaches. However, static solutions are adversely affected by obfuscation techniques and polymorphic applications, while dynamic ones cannot reduce the damages caused during applications execution. To this purpose, the following paper aims to propose a novel approach called API-Streams to minimize damages at Run-time. Therefore, we investigate several Video-Classification tasks through CNN-LSTM Autoencoders (CNN-LSTM-AEs). More precisely, we combine the capability of AEs in finding compact features with the classification abilities of Deep Neural Networks (DNNs), and we show that the proposed approach achieves an average accuracy of 98% in the presence of several unbalanced training datasets. Finally, we use the t-Stochastic Neighbor Embedded (t-SNE) representation technique to investigate the abilities of the employed AE to cluster data into their respective classes by limiting their overlapping.

关键词： android malware detection API-Streams Autoencoders Video classification

来源：评论

学校读者我要写书评

暂无评论

An Analysis on Different Distance Measures in KNN with PCA for android malware detection 22

An Analysis on Different Distance Measures in KNN with PCA f...

引用

22nd International Conference on Advances in ICT for Emerging Regions (ICTer)

作者： Dissanayake, Sayuru Gunathunga, Sankha Jayanetti, Dimalka Perera, Kavindu Liyanapathirana, Chethana Rupasinghe, Lakmal Sri Lanka Inst Informat Technol Fac Comp Malabe Sri Lanka

ISBN: (纸本)9798350346138

As Majority of the market is presently occupied by android consumers, android operating system is a prominent target for intruders. This research shows a dynamic android malware detection approach that classifies dangerous and trustworthy applications using system call monitoring. While the applications were in the execution phase, dynamic system call analysis was conducted on legitimate and malicious applications. Majority of relevant machine learning-based studies on detecting android malware frequently employ baseline classifier settings and concentrate on selecting either the best attributes or classifier. This study examines the performance of K Nearest Neighbor (KNN), factoring its many hyper-parameters with a focus on various distance metrics and this paper shows performance of KNN before and after performing Principal Component Analysis (PCA). The findings demonstrate that the classification performance may be significantly improved by using the adequate distance metric. KNN algorithm shows decent accuracy and improvement of efficiency such as decreasing the training time After PCA.

关键词： android System Calls K Nearest Neighbor Principal Component analysis android malware detection

来源：评论

学校读者我要写书评

暂无评论

MalWhiteout: Reducing Label Errors in android malware detection 7

MalWhiteout: Reducing Label Errors in Android Malware Detect...

引用

37th IEEE/ACM International Conference on Automated Software Engineering (ASE)

作者： Wang, Liu Wang, Haoyu Luo, Xiapu Sui, Yulei Huazhong Univ Sci & Technol Sch Cyber Sci & Engn Wuhan Peoples R China Hong Kong Polytechn Univ Hong Kong Peoples R China Univ Technol Sydney Sydney NSW Australia

ISBN: (纸本)9781450394758

Machine learning based android malware detection has attracted a great deal of research work in recent years. A reliable malware dataset is critical to evaluate the effectiveness of malware detection approaches. Unfortunately, existing malware datasets used in our community are mainly labelled by leveraging existing anti-virus services (i.e., VirusTotal), which are prone to mislabelling. This, however, would lead to the inaccurate evaluation of the malware detection techniques. Removing label noises from android malware datasets can be quite challenging, especially at a large data scale. To address this problem, we propose an effective approach called MalWhiteout to reduce label errors in android malware datasets. Specifically, we creatively introduce Confident Learning (CL), an advanced noise estimation approach, to the domain of android malware detection. To combat false positives introduced by CL, we incorporate the idea of ensemble learning and inter-app relation to achieve a more robust capability in noise detection. We evaluate MalWhiteout on a curated large-scale and reliable benchmark dataset. Experimental results show that MalWhiteout is capable of detecting label noises with over 94% accuracy even at a high noise ratio (i.e., 30%) of the dataset. MalWhiteout outperforms the state-of-the-art approach in terms of both effectiveness (8% to 218% improvement) and efficiency (70 to 249 times faster) across different settings. By reducing label noises, we show that the performance of existing malware detection approaches can be improved.

关键词： label noise android malware detection confident learning

来源：评论

学校读者我要写书评

暂无评论

Towards Multi-view android malware detection Through Image-based Deep Learning 18

Towards Multi-view Android Malware Detection Through Image-b...

引用

18th IEEE International Wireless Communications and Mobile Computing Conference (IWCMC)

作者： Geremias, Jhonatan Viegas, Eduardo K. Santin, Altair O. Britto, Alceu Horchulhack, Pedro Pontificia Univ Catolica Parana PUCPR Grad Program Comp Sci PPGIa Curitiba Parana Brazil Secure Syst Res Ctr Technol Innovat Inst TII Abu Dhabi U Arab Emirates

ISBN: (纸本)9781665467490

Over the last years, several works have proposed highly accurate android malware detection techniques. Surprisingly, modern malware apps can still pave their way to official markets, thus, demanding the provision of more robust and accurate detection approaches. This paper proposes a new multi-view android malware detection through image-based deep learning, implemented threefold. First, apps are evaluated according to several feature sets in a multi-view setting, thus, increasing the information provided for the classification task. Second, extracted feature sets are converted to an image format while maintaining the principal components of the data distribution, keeping the information for the classification task. Third, built images are jointly represented in a single shot, each in a predefined image channel, enabling the application of deep learning architectures. Experiments on a new version of a publicly available android malware dataset composed of over 11 thousand android apps have shown our proposal's feasibility. It reaches true-negative rates of up to 99.5% when implemented with a single-view approach with our new image-building technique. In addition, if our proposed multi-view scheme is used, the classification accuracies of malware families become more stable, reaching a true-positive rate of up to 98.7%.

关键词： android malware detection Deep Learning Static Analysis

来源：评论

学校读者我要写书评

暂无评论

EvadeDroid: A practical evasion attack on machine learning for black-box android malware detection

引用

COMPUTERS & SECURITY 2024年 139卷

作者： Bostani, Hamid Moonsamy, Veelasha Radboud Univ Nijmegen Inst Comp & Informat Sci Digital Secur Grp Nijmegen Netherlands Ruhr Univ Bochum Horst Gortz Inst IT Secur Bochum Germany

Over the last decade, researchers have extensively explored the vulnerabilities of android malware detectors to adversarial examples through the development of evasion attacks;however, the practicality of these attacks in real-world scenarios remains arguable. The majority of studies have assumed attackers know the details of the target classifiers used for malware detection, while in reality, malicious actors have limited access to the target classifiers. This paper introduces EvadeDroid, a problem-space adversarial attack designed to effectively evade black-box android malware detectors in real-world scenarios. EvadeDroid constructs a collection of problem-space transformations derived from benign donors that share opcode-level similarity with malware apps by leveraging an n-gram-based approach. These transformations are then used to morph malware instances into benign ones via an iterative and incremental manipulation strategy. The proposed manipulation technique is a query-efficient optimization algorithm that can find and inject optimal sequences of transformations into malware apps. Our empirical evaluations, carried out on 1K malware apps, demonstrate the effectiveness of our approach in generating real-world adversarial examples in both soft- and hard-label settings. Our findings reveal that EvadeDroid can effectively deceive diverse malware detectors that utilize different features with various feature types. Specifically, EvadeDroid achieves evasion rates of 80%-95% against DREBIN, Sec-SVM, ADE-MA, MaMaDroid, and Opcode-SVM with only 1-9 queries. Furthermore, we show that the proposed problem-space adversarial attack is able to preserve its stealthiness against five popular commercial antiviruses with an average of 79% evasion rate, thus demonstrating its feasibility in the real world.

关键词： Query-based evasion attacks android malware detection Machine learning Black-box adversarial attacks

来源：评论

学校读者我要写书评

暂无评论

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案：

请选择收藏分类：

通借通还

建议与咨询 留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案： 新增检索档案 确定 取消

请选择收藏分类： 新增自定义分类 确定 取消

通借通还

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

请选择保存的检索档案：

请选择收藏分类：