Earthworm optimization algorithm based cascade LSTM-GRU model for android malware detection

Defending malware detection models against evasion based adversarial attacks

The last five years have shown a tremendous increase in the number of Android smartphone users. So has been the case with malicious Android applications that aim to jeopardize user data, security, and privacy. Most existing Android malware detection engines find it challenging to keep up with the pace of incoming malware and their sophistication of evasion techniques against the detection engines. This has prompted researchers to delve into using machine learning and deep learning algorithms to construct state-of-the-art malware detection models. However, research indicates that these detection models might be vulnerable to adversarial attacks prompting a thorough investigation. Therefore, we first propose a image based malware detection pipeline that uses an embedding layer-based hybrid CNN named E-CNN that uses Android permissions and intents as features for malware detection. The permission and intent based E-CNN detection models achieved baseline accuracy of \(93.48\%\) and \(76.7\%\) respectively. We then act as an adversary and propose the ECO-FGSM adversarial evasion attack against the above detection models. The ECO-FGSM attack converts malware samples into adversarial malware samples so that they are forcefully misclassified as benign by the detection models. The proposed attack achieved a high fooling rate of \(55.72\%\) and \(99.97\%\) against permission and intent based E-CNN detection models, respectively. We also identified a list of most vulnerable permissions and intents to generate adversarial samples. We then use adversarial retraining as a defense strategy to counter the ECO-FGSM attack against the detection models. The adversarial defense helped improve the baseline accuracies of permission and intent based E-CNN detection models by \(3.41\%\) and \(11.4\%\), respectively. We re-attack the adversarially retrained models using the ECO-FGSM attack to validate their adversarial robustness. We found a reduction in the fooling rate by \(23.28\%\) and \(97.55\%\) against permission and intent-based E-CNN detection models, respectively. Finally, we conclude that investigating the adversarial robustness of the malware detection models is an essential step that helps improve their performance and robustness before real-world deployment. KeywordsAndroidAdversarial robustnessConvolutional Neural NetworkEvasion attackMalware detection

The last decade witnessed an exponential rise of Android smartphones and malware attacks on them. Researchers have investigated and proposed many promising malware detection models based on machine learning. However, these malware detection models are susceptible to adversarial attacks which threaten the Android security ecosystem. In this article, we propose to develop malware detection models which are more robust against adversarial attacks. We first designed an i-bit adversarial attack policy which achieved an average fooling rate of 51% with maximum ten modifications across twelve different malware detection models. Later we also propose an adversarial defence mechanism which enhanced the robustness of the malware detection models by reducing the fooling rate to one-third against the same adversarial attack.

The traditional neural network can maintain the performance of identifying Android malware by learning Android characteristics. But owing to the rapid growth of Android information, it cannot deal with the massive data efficiently for millions of Android applications. In this paper, we propose a novel NN-based model (RaNetMalDozer) for Android malware detection to improve the accuracy rate of classification and the training speed. The RaNetMalDozer (RNMD) can dynamically select hidden centers by a heuristic approach and expeditiously gather the large-scale datasets of 12,750 Android applications. To systematically analyze Android kernel behaviors, we investigate 112 Android kernel features of task_struct and offer forensic analysis of key kernel features. Furthermore, compared to the traditional neural network, EBPN method which achieves an accuracy rate of 81%, our RNMD model achieves an accuracy rate of 94% with half of training and evaluation time. Our experiments also demonstrate the RNMD model can be used as a better technique of Android malware detection.

Today, in the field of malware detection, the expanding limitations of traditional detection methods and the increasing accuracy of detection methods designed on the basis of artificial intelligence algorithms are driving research findings in this area in favour of the latter. Therefore, we propose a novel malware detection model in this paper. This model combines a grey-scale image representation of malware with an autoencoder network in a deep learning model, analyses the feasibility of the grey-scale image approach of malware based on the reconstruction error of the autoencoder, and uses the dimensionality reduction features of the autoencoder to achieve the classification of malware from benign software. The proposed detection model achieved an accuracy of 96% and a stable F-score of about 96% by using the Android-side dataset we collected, which outperformed some traditional machine learning detection algorithms.

Malware detection from the smartphone has become a challenging issue for academicians and researchers. In this research paper, we applied five distinct machine learning algorithms and three different ensemble methods to develop a model for detecting malware from an Android-based smartphone. In this study, we proposed a framework that helps in selecting the right sets of the feature with an aim to improve the performance of the malware detection models. The proposed malware detection framework is then validated by considering two distinct performance parameters, i.e., accuracy and F-measure as a benchmark to detect malware from real-world apps. We performed an empirical study on thirty different categories of Android apps. The experimental data set consists of 1,94,659 benign apps and 67,538 malware apps that are collected from different promised repositories. Empirical results reveal that the models developed by using the proposed feature selection framework are able to detect more malware-infected apps when compared to all extracted feature sets. Moreover, the malware detection model build by using nonlinear ensemble decision tree forest (NDTF) approach is achieved a detection rate of 98.8%. In addition to that, the proposed malware detection framework is more effective in detecting malware-infected apps as compared to different anti-virus scanners and different frameworks or approaches developed in the literature.

Modern Android malware changes rapidly, making it hard for traditional anti-malware methods to identify these new, disguised and flexible threats. Because existing solutions have issues with many false positives, difficulty handling several types of malware and slow reaction times, hence the work introduce TriSentry-MD as a novel framework for detecting malware in an efficient manner in real time with greater more accurately. The proposed work main breakthrough is achieved by incorporating three different yet matching techniques: GrayCodeNet, to image the resultant bytecode and examine it with convolutional neural networks and a novel BehavWatch-X, which perform normalization and aggregate execution into behaviour feature vector that monitor run time metrics includes CPU usage, battery consumption, network activity, and system calls. Along with proposed ReVersaLearn, a technique for reverse-engineering and using app metadata in classification. Thus, it starts with getting an APK, dividing it into static analysis, bytecode analysis and testing its behaviour in a virtual sandbox. The implementation outputs are gathered and turned into a final outcome by the soft voting process. With harmless attacks from Drebin and AMD, TriSentry-MD obtained near-perfect detection accuracy and almost no false alarms. The findings demonstrate that using Manuscript Click here to access/download;Manuscript;Manuscript.docx multiple data types in a unified framework is effective for discovering a wider variety of android threats and making threat detection more accurate and stronger.

Towards an interpretable deep learning model for mobile malware detection and family identification

A multi-tiered feature selection model for android malware detection based on Feature discrimination and Information Gain

Antivirus software is one of the most widely installed software for protecting computer from malicious attacks. However, traditional host-based antivirus needs to store all viruses' pattern or sample, which not only needs large local storage, but also fails to detect modern threats in time. The newly come cloud-based antivirus, which needs no extra local storage and compares virus' pattern on provider's cloud servers, has the disadvantages of being more likely to be attacked when offline. This paper advocates P2PAV, a new model for malware detection through P2P network, which takes advantages of traditional ones and cloud antivirus, reduces local storage, and meanwhile, improves the ability of detecting modern virus than traditional ways, and combating virus when offline than cloud-based antivirus.

Malware detection plays a critical role in securing endpoints such as workstations, servers, cloud instances, and mobile devices. It involves identifying and mitigating malicious activities triggered by various forms of malware, including viruses, trojans, worms, ransomware, adware, and spyware. With the rapid proliferation of sophisticated and evasive malware variants, such as polymorphic and metamorphic malware, traditional signature-based and heuristic approaches are no longer sufficient. These conventional methods often fail to detect previously unseen or obfuscated threats, making the adoption of more intelligent and adaptive systems essential. In response to this challenge, this project explores the application of machine learning techniques to enhance malware detection and classification. Leveraging publicly available malware datasets, various supervised and unsupervised algorithms—such as Decision Trees, Random Forests, Support Vector Machines (SVM), k-Nearest Neighbors (k-NN), Naïve Bayes, and Artificial Neural Networks (ANN)—will be employed and evaluated. Additionally, feature extraction and dimensionality reduction techniques such as Principal Component Analysis (PCA) will be applied to improve model performance. The objective is to assess and compare the models using metrics such as accuracy, precision, recall, F1-score, and confusion matrix analysis. This project aims to identify the most effective machine learning model for real-time, scalable, and accurate malware detection, contributing to improved cybersecurity practices and proactive threat mitigation. Keywords: Malware detection, machine learning, enterprise security, information gain, random forest, PE analysis, API calls.

Existing research in malware detection and classification has focused on the higher accuracy of the results. Generally, high accuracy is achieved through a large set of entropy features in most of the existing frameworks. However, detection and classification time (which also includes the feature extraction time) have largely been neglected in past studies. In this paper, we propose a neural network-based model for Windows-based malware detection and classification. We also study the impact of reducing the number of features, feature types, and feature extraction time on the accuracy of malware detection and classification. We compared our model with Gaussian Naive Bayes (gNB), Logistic Regression (LR), K-Nearest Neighbor (KNN), Classification and Regression Trees (CART), Random Forest (RF), and Extreme Gradient Boosting (XGB). Our proposed model achieves the highest accuracy of 92.17% for detection and 98.41% for classification by using only 100 features of entropy. Results demonstrate that by replacing entropy features with the GINI-index features and by adjusting feature sets, we can get 21.93% faster detection and 15.6% faster classification at the cost of less than 3% and 2% reduction in accuracy respectively.

The Internet of Things (IoT) has become a technological innovation that brings many benefits in various sectors, but also presents challenges, especially in terms of cybersecurity. One of the main threats is malware, which can damage devices, steal data, and disrupt system performance. With the increasing use of IoT, malware attacks on IoT devices are a serious concern. Previous research shows that malware detection models in IoT devices still have shortcomings, especially in terms of accuracy. One of the algorithms used in malware detection, Naïve Bayes, has been shown to provide low accuracy results. This study aims to improve the accuracy of malware detection on IoT networks by applying Ensemble learning techniques using traffic data from the IoT-23 dataset. The methodology used refers to the CRISP-DM (Cross Industry Standard Process for Data Mining) framework, which includes the stages of domain understanding, data understanding, data preparation, modelling, evaluation, and deployment. The results show that Ensemble learning improved the performance of individual models. Naïve Bayes as a single model produces an accuracy of 0.24, increasing to 0.35 when combined with AdaBoost, and 0.99 when combined with XGBoost. The combination of the three models also produced an accuracy of 0.99. These results demonstrate the effectiveness of ensemble learning in improving malware detection accuracy in IoT environments.

In recent years, the increasing number of malicious software has led to more and more serious security threats to computers or network. The researches have been devoting significant efforts to solve the numerous challenges in malware detection and a large amount of literature available which worthies deeply analyzing and sorting out to offer guidance for the developmental research on malicious code detection. In this paper, the visualized tool of CiteSpace is used to assess the current state and explore the trends of malware research based on the bibliographic records retrieved from the China National Knowledge Internet. We analyze the malware research in a scientific and systematic way and display the research status and possible development trend in this field concisely and intuitively, which provide the theoretical basis for the in-depth study of malware detection for the scientific research. Finally, the malware detection model is designed according to the analysis results of Mapping Knowledge Domain to achieve effective and efficient performance in malware detection.

Smali code-based deep learning model for Android malware detection