Federated learning-based robust android malware detection: label-flipping attacks and defenses

Android based Smartphones are nowadays getting more popular. While using Smartphone, user is always concerned about security and malicious attacks, cryptographic vulnerability of the applications. With increase in the number of Android mobiles, Android malwares are also increasing very rapidly. So the authors have proposed the “Identification of cryptographic vulnerability and malware detection in Android” system. They have designed a user friendly android application, through which user and developer can easily test the application whether it is benign or vulnerable. The application will be tested firstly using static analysis and then the dynamic analysis will be carried out. The authors have implemented static and dynamic analysis of android application for vulnerable and malicious app detection. They have also created a web page. User can either use the application or the web page.

With the increase in the popularity of mobile devices, malicious applications targeting Android platform have greatly increased. Malware is coded so prudently that it has become very complicated to identify. The increase in the large amount of malware every day has made the manual approaches inadequate for detecting the malware. Nowadays, a new malware is characterized by sophisticated and complex obfuscation techniques. Thus, the static malware analysis alone is not enough for detecting it. However, dynamic malware analysis is appropriate to tackle evasion techniques but incapable to investigate all the execution paths and also it is very time consuming. So, for better detection and classification of Android malware, we propose a hybrid approach which integrates the features obtained after performing static and dynamic malware analysis. This approach tackles the problem of analyzing, detecting and classifying the Android malware in a more efficient manner. In this paper, we have used a robust set of features from static and dynamic malware analysis for creating two datasets i.e. binary and multiclass (family) classification datasets. These are made publically available on GitHub and Kaggle with the aim to help researchers and anti-malware tool creators for enhancing or developing new techniques and tools for detecting and classifying Android malware. Various machine learning algorithms are employed to detect and classify malware using the features extracted after performing static and dynamic malware analysis. The experimental outcomes indicate that hybrid approach enhances the accuracy of detection and classification of Android malware as compared to the case when static and dynamic features are considered alone.

Android malware poses severe threats to users, hence raising an urgent demand for malware detection. In-cloud Android malware detection often suffers privacy leakage and communication overheads. Therefore, this article focuses on on-device Android malware detection. At present, on-device malware detectors are usually trained on servers and then transplanted to mobile devices (e.g., smartphones). In practice, on-device training is particularly important due to the demand for offline updates. Because mobile devices are limited in resource, however, on-device training is hard to implement, especially for those high-complexity malware detectors. To overcome this challenge, we design a lightweight on-device Android malware detector, based on the recently proposed broad learning method. Our detector mainly uses one-shot computation for model training. Hence it can be fully or incrementally trained directly on mobile devices. As far as detection accuracy is concerned, our detector outperforms the shallow learning-based models, including support vector machine (SVM) and AdaBoost, and approaches the deep learning-based models multilayer perceptron (MLP) and convolutional neural network (CNN). Moreover, our detector is more robust to adversarial examples than the existing detectors, and its robustness can be further improved through on-device model retraining. Finally, its advantages are confirmed by extensive experiments, and its practicality is demonstrated through runtime evaluation on smartphones.

Over the past few years, Android Application is deemed as one of the fastest-growing technology areas. On the other hand, the rapid growth of android applications also increases the security threats for Android users in the form of malware. Malware hacks the personal information of a user and exploits it in different criminal activities. To date, various studies have been conducted for the detection of android malware. Some authors have preferred static analysis while others have performed dynamic analysis for android malware detection. In static analysis, researchers have only employed one feature of android application either intents or permissions. As best of our knowledge, there does not exist any technique that combines both intents and permissions. In this paper, we have performed static analysis for the detection of Android malware using android intents (both implicit and explicit), android permissions and combination of intents and permissions. Furthermore, the classification is performed to analyze the effectiveness of different machine learning algorithms for malware detection and to identify the best performing feature. Our experiment results show that combination of intents and permissions play a key role in the detection of android malware.

EfficientNet convolutional neural networks-based Android malware detection

The proliferation of IoT technologies has increased Android-based consumer electronics software, while these applications are susceptible to malware attacks. Applying network traffic for Android malware detection is being extensively developed. Existing approaches primarily focus on statistical features or visualized features of network traffic to detect malware. However, they require labeled data to maintain the detection accuracy. To further enhance detection accuracy and reduce the labeling rate of data, NFNI-MGATMg is proposed to detect Android malware and classify malware categories. First, the Network Flow Node Interaction Graph (NFNI) is introduced to convert the network traffic into the graph. Subsequently, the line graph principle is employed to transform the edges of NFNI into nodes, and both the node graphs and edge-node graphs are fed into the Multi-layer Graph Attention Network Merger (MGATMg) model to aggregate neighbor nodes for effective Android malware detection with limited labeled data. By leveraging MGATMg, it is possible to effectively capture both structural features and statistical features of network traffic, thereby enhancing the accuracy of malware detection. Finally, comprehensive experiments are designed to verify the effectiveness of our framework; the F1-scores of our model reached 98.83% and 91.7% for malware detection and malware category classification, respectively.

With explosive growth of Android malware and due to the severity of its damages to smart phone users, the detection of Android malware has become increasingly important in cybersecurity. The increasing sophistication of Android malware calls for new defensive techniques that are capable against novel threats and harder to evade. In this paper, to detect Android malware, instead of using Application Programming Interface (API) calls only, we further analyze the different relationships between them and create higher-level semantics which require more effort for attackers to evade the detection. We represent the Android applications (apps), related APIs, and their rich relationships as a structured heterogeneous information network (HIN). Then we use a meta-path based approach to characterize the semantic relatedness of apps and APIs. We use each meta-path to formulate a similarity measure over Android apps, and aggregate different similarities using multi-kernel learning. Then each meta-path is automatically weighted by the learning algorithm to make predictions. To the best of our knowledge, this is the first work to use structured HIN for Android malware detection. Comprehensive experiments on real sample collections from Comodo Cloud Security Center are conducted to compare various malware detection approaches. Promising experimental results demonstrate that our developed system HinDroid outperforms other alternative Android malware detection techniques.

With the growing popularity of autonomous vehicles, ensuring their safety has become a significant concern. Vehicle manufacturers have incorporated the Android operating system to enhance user convenience. However, the Android operating system's diversity and vulnerability may significantly impact autonomous vehicles because these natures lead to a critical threat in autonomous vehicle security: Android malware. The complex nature of multi‐data sources fusion in autonomous driving systems has resulted in low detection efficiency and accuracy for Android malware. Given the security requirements for autonomous‐driving systems, this article presents an Android malware classification method centered around the multifeature fusion and deep learning architecture designed to detect and classify Android malware within autonomous‐driving systems. The proposed MUDROID framework relies on the Android permission mechanism and behavioral feature to formulate a malware classification model. Comprising four essential components—feature extraction, representation, multifeature fusion, and classifier training, MUDROID leverages the advantages of CNN and GCN combination model and is adept at extracting and interpreting multidimensional features, consequently constructing a multifeature fusion classifier to amplify the efficiency and accuracy of Android malware detection and classification. The experiment results support MUDROID's superior classification performance, with an impressive Android malware detection accuracy rate of 98.69% and family classification (95.42%). The proposed method can detect and classify Android malware effectively, thus elevating the security and robustness of the self‐driving system. Additionally, the approach in this article also addresses feature representation issues in detecting malware variants, facilitating the recognition of Android malware variants across diverse platforms.

With the popularity of smartphones and mobile applications, the threat of Android malware is increasingly serious.The analysis and behaviour modelling of Android malware features is studied to realize the efficient and accurate detection of Android malware, and an Android malware detection method combining mean aggregator and long-term and short-term memory is proposed.The results show that the improved system detection time is relatively stable regardless of the number of samples.The average detection time of the improved and unimproved systems is 0.274 s and 0.336 s, respectively, and the improved detection efficiency of the improved system is more prominent.The highest improvement rate of the enhanced system reached 18.2%.Compared with other models, the average absolute error and root mean square error were the smallest, with 3.84 and 6.26, respectively, indicating that the detection performance of the improved model is the best.With permission features and third-party library features, the accuracy of the enhanced model was 98.89% and 92.65%, and the recall rate was 99.24% and 99.09%, respectively.The improved model detection performance is good, and the robustness and stability are enhanced.Applied to actual Android devices, it can improve the security and privacy protection level of user data.This method ensures enhanced efficiency and stability and provides a certain reference direction for Android malware detection.

With the widespread popularity of Internet of Things (IoT) devices based on the Android system, the amount of Android malware targeting IoT devices continues to increase, causing great economic losses. Accordingly, efficient and accurate Android malware detection methods are particularly important. Recently, many Android malware detection and classification methods have been proposed, but most of them ignore the deep relationships among software. In this article, we propose a graph compression algorithm with reachability relationship extraction (GCRR) and design an Android malware detection and classification method called GCDroid based on this algorithm. A theoretical analysis shows that GCRR can reasonably extract the reachability relationships among APKs and compress a large heterogeneous APK–API relationship graph into a homogeneous APKs graph. Experiments show that GCDroid based on GCRR greatly reduces the required time consumption while improving detection accuracy. Compared with the existing excellent static Android malware detection methods, GCDroid improves upon their detection accuracies by 1.53%–39.13% on different data sets and outperforms the benchmark methods in terms of Android malware classification. Furthermore, compared with those of the baseline methods that are similar to GCDroid, GCDroid’s time consumption for model training and other aspects is only one-tenth as high or even less.

Predicting attacks in Android Malware (AM) devices within recommender systems-based IoT is challenging. A novel framework is presented in this study for AM Detection (AMD) using BERT Ensemble (MBR) and MobileNetV2. The MBR model uses a threat analysis technique to assess Android apps by using a subset of 100 permissions from 329 Android application-based permissions, together with a refined feature set. Using MCADS, DroidRL, CNN, FAGnet, GAN, and FEDriod, the MBR model performs exceptionally well, achieving 98% accuracy, 96% precision, 98% recall, 97% F1-score, and a log loss of 0.058. By leveraging their strengths, the MBR model introduces significant innovation. By using ensemble methods on static data, the MBR framework not only provides a reliable malware detection solution but also presents a novel strategy. This research highlights the potential for significant applications in this dynamic and evolving field by addressing user privacy and system security issues, despite the growing Android malware risks in IoT.

The increasing number of mobile devices using the Android operating system in the market makes these devices the first target for malicious applications. In recent years, several Android malware applications were developed to perform certain illegitimate activities and harmful actions on mobile devices. In response, specific tools and anti-virus programs used conventional signature-based methods in order to detect such Android malware applications. However, the most recent Android malware apps, such as zero-day, cannot be detected through conventional methods that are still based on fixed signatures or identifiers. Therefore, the most recently published research studies have suggested machine learning techniques as an alternative method to detect Android malware due to their ability to learn and use the existing information to detect the new Android malware apps. This paper presents the basic concepts of Android architecture, Android malware, and permission features utilized as effective malware predictors. Furthermore, a comprehensive review of the existing static, dynamic, and hybrid Android malware detection approaches is presented in this study. More significantly, this paper empirically discusses and compares the performances of six supervised machine learning algorithms, known as K-Nearest Neighbors (K-NN), Decision Tree (DT), Support Vector Machine (SVM), Random Forest (RF), Naïve Bayes (NB), and Logistic Regression (LR), which are commonly used in the literature for detecting malware apps.

The exponentially growing use and popularity of the Android Operating System made it more prone to malware attacks. Easy to use android smartphones attracted intruders which resulted in the need for a novel malware detection method. Several works are proposed which makes use of machine learning techniques to detect malign and benign applications. To provide the solution of addressed problem of detection of malware in android, in this paper, we have provided a decent approach based on static analysis of the android apk for feature extraction like API Calls, Intents, Permissions and Command signature. We have used the Drebin[2] [26] and Malgenome[35] datasets, both the datasets have a good amount of goodwares and malwares to train the machine learning classifier. After feature extraction from android APK (Android Package Kit), we performed various experiments taking into consideration all the combined extracted features as well as generated the twosome combination of permission. By taking all four extracted features our model achieved a high classification accuracy of 98.19% with Drebin Dataset and with the twosome permission combination it achieved an accuracy of 96.27% with the RF model. Additionally, in the case of Malgenome Dataset, we have an accuracy of 98.84% considering all four features and 97.63% in the case of permission twosome combination SVM with PCA (Principal Component Analysis). Both experiments have given a decent result compared to some of the existing work considering the same scenario in the android malware domain.

As the use of smartphones increases, Android, as a Linux-based open source mobile operating system (OS), has become the most popular mobile OS in time. Due to the widespread use of Android, malware developers mostly target Android devices and users. Malware detection systems to be developed for Android devices are important for this reason. Machine learning methods are being increasingly used for detection and analysis of Android malware. This study presents a method for detecting Android malware using feature selection with genetic algorithm (GA). Three different classifier methods with different feature subsets that were selected using GA were implemented for detecting and analyzing Android malware comparatively. A combination of Support Vector Machines and a GA yielded the best accuracy result of 98.45% with the 16 selected permissions using the dataset of 1740 samples consisting of 1119 malwares and 621 benign samples.

Alongside the recognition of the android operating system (OS), android malware is on the increase. Cybercriminals are using different techniques to develop malware for android devices. In addition, malware authors are trying to make malicious android applications that severely undermine the potential of traditional malware detectors. The key purpose of the chapter is to analyze and have a different appearance at various techniques of Android malware detection in a variety of research articles. However, this chapter presents an analysis of varied android malware detection approaches and comparing them to supported various parameters like detection technique, analysis method, features extracted and so on. The experiments are based on substantial malware datasets, evaluation parameters and this study employ a wide variety of machine learning techniques, including decision trees and random forests, support vector machines, logistic model trees, and artificial neural networks, also Deep learning techniques. It is a comparative analysis that should be useful in this field for researchers. The analysis shows, based on simple criteria, the similarities and differences in essential published research in addition to the accuracy. Thus, this chapter aims to study various android malware detection techniques and to identify plausible research directions. The findings showed that machine learning, with greater detection accuracy, is a more promising method. In order to achieve improved accuracy, future researchers can pursue a deep learning approach with the use of a large dataset.