HGDetector: A hybrid Android malware detection method using network traffic and Function call graph

In order to improve the detection efficiency of Android malicious application, an Android malware detection system based on feature fusion is proposed on three levels. Feature fusion especially emphasizes on ten categories, which combines static and dynamic features and includes 377 features for classification. In order to improve the accuracy of malware detection, attribute subset selection and principle component analysis are used to reduce the dimensionality of fusion features. Random forest is used for classification. In the experiment, the dataset includes 43,822 benign applications and 8,454 malicious applications. The method can achieve 99.4% detection accuracy and 0.6% false positive rate. The experimental results show that the detection method can improve the malware detection efficiency in Android platform.

SummaryMalware is a constant threat to the safety of the public Internet and private networks. It also affects the security of endpoint devices. An infected endpoint device can take part in aggressive or slow distributed denial of service attacks globally. Polymorphic malware has rendered traditional signature‐based detection ineffective. Hence the efforts to identify malware have been focused on behavioral modeling to identify and classify malware. This behavioral identification paved the way for artificial intelligence (AI) in cybersecurity. AI can detect a zero‐day attack and malware, but it suffers from several false positives. This article presents an extensive analysis of traditional and AI‐based methods for malware detection and related challenges. AI is vulnerable to attacks, such as dataset poisoning and adversarial data input, which can reduce model accuracy and increase false negatives. AI has helped to improve malware detection and reduce manual work through automation of feature extraction and feature selection. It is also beneficial to create models that are less prone to malware variations and capture the malicious behavior holistically. This article explores the transition of malware detection from traditional to AI‐based techniques. Furthermore, it also explains how some conventional approaches are still relevant today in terms of detection speed.

Broadening The Solution Space of Feature Selection in Time-interval-based Malware Detection

With the popularity of smartphones and mobile applications, the threat of Android malware is increasingly serious.The analysis and behaviour modelling of Android malware features is studied to realize the efficient and accurate detection of Android malware, and an Android malware detection method combining mean aggregator and long-term and short-term memory is proposed.The results show that the improved system detection time is relatively stable regardless of the number of samples.The average detection time of the improved and unimproved systems is 0.274 s and 0.336 s, respectively, and the improved detection efficiency of the improved system is more prominent.The highest improvement rate of the enhanced system reached 18.2%.Compared with other models, the average absolute error and root mean square error were the smallest, with 3.84 and 6.26, respectively, indicating that the detection performance of the improved model is the best.With permission features and third-party library features, the accuracy of the enhanced model was 98.89% and 92.65%, and the recall rate was 99.24% and 99.09%, respectively.The improved model detection performance is good, and the robustness and stability are enhanced.Applied to actual Android devices, it can improve the security and privacy protection level of user data.This method ensures enhanced efficiency and stability and provides a certain reference direction for Android malware detection.

With the increase in the popularity of mobile devices, malicious applications targeting Android platform have greatly increased. Malware is coded so prudently that it has become very complicated to identify. The increase in the large amount of malware every day has made the manual approaches inadequate for detecting the malware. Nowadays, a new malware is characterized by sophisticated and complex obfuscation techniques. Thus, the static malware analysis alone is not enough for detecting it. However, dynamic malware analysis is appropriate to tackle evasion techniques but incapable to investigate all the execution paths and also it is very time consuming. So, for better detection and classification of Android malware, we propose a hybrid approach which integrates the features obtained after performing static and dynamic malware analysis. This approach tackles the problem of analyzing, detecting and classifying the Android malware in a more efficient manner. In this paper, we have used a robust set of features from static and dynamic malware analysis for creating two datasets i.e. binary and multiclass (family) classification datasets. These are made publically available on GitHub and Kaggle with the aim to help researchers and anti-malware tool creators for enhancing or developing new techniques and tools for detecting and classifying Android malware. Various machine learning algorithms are employed to detect and classify malware using the features extracted after performing static and dynamic malware analysis. The experimental outcomes indicate that hybrid approach enhances the accuracy of detection and classification of Android malware as compared to the case when static and dynamic features are considered alone.

Beyond the sandbox: Leveraging symbolic execution for evasive malware classification

Android malware obfuscation variants detection method based on multi-granularity opcode features

As accurate malware detection on mobile devices requires fast process of a large number of application traces, cloud-based malware detection can utilize the data sharing and powerful computational resources of security servers to improve the detection performance. In this paper, we investigate the cloud-based malware detection game, in which mobile devices offload their application traces to security servers via base stations or access points in dynamic networks. We derive the Nash equilibrium (NE) of the static malware detection game and present the existence condition of the NE, showing how mobile devices share their application traces at the security server to improve the detection accuracy, and compete for the limited radio bandwidth, the computational and communication resources of the server. We design a malware detection scheme with Q-learning for a mobile device to derive the optimal offloading rate without knowing the trace generation and the radio bandwidth model of other mobile devices. The detection performance is further improved with the Dyna architecture, in which a mobile device learns from the hypothetical experience to increase its convergence rate. We also design a post-decision state learning-based scheme that utilizes the known radio channel model to accelerate the reinforcement learning process in the malware detection. Simulation results show that the proposed schemes improve the detection accuracy, reduce the detection delay, and increase the utility of a mobile device in the dynamic malware detection game, compared with the benchmark strategy.

Existing research in malware detection and classification has focused on the higher accuracy of the results. Generally, high accuracy is achieved through a large set of entropy features in most of the existing frameworks. However, detection and classification time (which also includes the feature extraction time) have largely been neglected in past studies. In this paper, we propose a neural network-based model for Windows-based malware detection and classification. We also study the impact of reducing the number of features, feature types, and feature extraction time on the accuracy of malware detection and classification. We compared our model with Gaussian Naive Bayes (gNB), Logistic Regression (LR), K-Nearest Neighbor (KNN), Classification and Regression Trees (CART), Random Forest (RF), and Extreme Gradient Boosting (XGB). Our proposed model achieves the highest accuracy of 92.17% for detection and 98.41% for classification by using only 100 features of entropy. Results demonstrate that by replacing entropy features with the GINI-index features and by adjusting feature sets, we can get 21.93% faster detection and 15.6% faster classification at the cost of less than 3% and 2% reduction in accuracy respectively.

This study addresses the challenge of Android malware detection, a critical issue due to the pervasive threats affecting mobile devices. As Android malware evolves, conventional detection methods struggle with novel or polymorphic malware that bypasses traditional defenses. This research leverages machine learning (ML) and deep learning (DL) techniques to overcome these limitations by adopting domain adaptation strategies that enhance model generalization across different distributions. The approach involves dividing a dataset into distinct distributions and applying domain adaptation techniques to ensure robustness and accuracy despite distribution shifts. Preliminary results demonstrate that domain adaptation significantly improves detection accuracy in target domains not represented in the training data. This paper showcases a domain adaptation-based method for Android malware detection, illustrating its potential to enhance security measures in dynamic environments. The findings suggest that integrating advanced ML and DL strategies with domain adaptation can substantially improve the efficacy of malware detection systems.

The proliferation of IoT technologies has increased Android-based consumer electronics software, while these applications are susceptible to malware attacks. Applying network traffic for Android malware detection is being extensively developed. Existing approaches primarily focus on statistical features or visualized features of network traffic to detect malware. However, they require labeled data to maintain the detection accuracy. To further enhance detection accuracy and reduce the labeling rate of data, NFNI-MGATMg is proposed to detect Android malware and classify malware categories. First, the Network Flow Node Interaction Graph (NFNI) is introduced to convert the network traffic into the graph. Subsequently, the line graph principle is employed to transform the edges of NFNI into nodes, and both the node graphs and edge-node graphs are fed into the Multi-layer Graph Attention Network Merger (MGATMg) model to aggregate neighbor nodes for effective Android malware detection with limited labeled data. By leveraging MGATMg, it is possible to effectively capture both structural features and statistical features of network traffic, thereby enhancing the accuracy of malware detection. Finally, comprehensive experiments are designed to verify the effectiveness of our framework; the F1-scores of our model reached 98.83% and 91.7% for malware detection and malware category classification, respectively.

Android malware poses severe threats to users, hence raising an urgent demand for malware detection. In-cloud Android malware detection often suffers privacy leakage and communication overheads. Therefore, this article focuses on on-device Android malware detection. At present, on-device malware detectors are usually trained on servers and then transplanted to mobile devices (e.g., smartphones). In practice, on-device training is particularly important due to the demand for offline updates. Because mobile devices are limited in resource, however, on-device training is hard to implement, especially for those high-complexity malware detectors. To overcome this challenge, we design a lightweight on-device Android malware detector, based on the recently proposed broad learning method. Our detector mainly uses one-shot computation for model training. Hence it can be fully or incrementally trained directly on mobile devices. As far as detection accuracy is concerned, our detector outperforms the shallow learning-based models, including support vector machine (SVM) and AdaBoost, and approaches the deep learning-based models multilayer perceptron (MLP) and convolutional neural network (CNN). Moreover, our detector is more robust to adversarial examples than the existing detectors, and its robustness can be further improved through on-device model retraining. Finally, its advantages are confirmed by extensive experiments, and its practicality is demonstrated through runtime evaluation on smartphones.

The exponentially growing use and popularity of the Android Operating System made it more prone to malware attacks. Easy to use android smartphones attracted intruders which resulted in the need for a novel malware detection method. Several works are proposed which makes use of machine learning techniques to detect malign and benign applications. To provide the solution of addressed problem of detection of malware in android, in this paper, we have provided a decent approach based on static analysis of the android apk for feature extraction like API Calls, Intents, Permissions and Command signature. We have used the Drebin[2] [26] and Malgenome[35] datasets, both the datasets have a good amount of goodwares and malwares to train the machine learning classifier. After feature extraction from android APK (Android Package Kit), we performed various experiments taking into consideration all the combined extracted features as well as generated the twosome combination of permission. By taking all four extracted features our model achieved a high classification accuracy of 98.19% with Drebin Dataset and with the twosome permission combination it achieved an accuracy of 96.27% with the RF model. Additionally, in the case of Malgenome Dataset, we have an accuracy of 98.84% considering all four features and 97.63% in the case of permission twosome combination SVM with PCA (Principal Component Analysis). Both experiments have given a decent result compared to some of the existing work considering the same scenario in the android malware domain.

With the growing popularity of autonomous vehicles, ensuring their safety has become a significant concern. Vehicle manufacturers have incorporated the Android operating system to enhance user convenience. However, the Android operating system's diversity and vulnerability may significantly impact autonomous vehicles because these natures lead to a critical threat in autonomous vehicle security: Android malware. The complex nature of multi‐data sources fusion in autonomous driving systems has resulted in low detection efficiency and accuracy for Android malware. Given the security requirements for autonomous‐driving systems, this article presents an Android malware classification method centered around the multifeature fusion and deep learning architecture designed to detect and classify Android malware within autonomous‐driving systems. The proposed MUDROID framework relies on the Android permission mechanism and behavioral feature to formulate a malware classification model. Comprising four essential components—feature extraction, representation, multifeature fusion, and classifier training, MUDROID leverages the advantages of CNN and GCN combination model and is adept at extracting and interpreting multidimensional features, consequently constructing a multifeature fusion classifier to amplify the efficiency and accuracy of Android malware detection and classification. The experiment results support MUDROID's superior classification performance, with an impressive Android malware detection accuracy rate of 98.69% and family classification (95.42%). The proposed method can detect and classify Android malware effectively, thus elevating the security and robustness of the self‐driving system. Additionally, the approach in this article also addresses feature representation issues in detecting malware variants, facilitating the recognition of Android malware variants across diverse platforms.

The focus of a large amount of research on malware detection is currently working on proposing and improving neural network structures, but with the constant updates of Android, the proposed detection methods are more like a race against time. Through the analysis of these methods, we found that the basic processes of these detection methods are roughly the same, and these methods rely on professional reverse engineering tools for malware analysis and feature extraction. These tools generally have problems such as high time-space cost consumption, difficulty in achieving concurrent analysis of a large number of Apk, and the output results are not convenient for feature extraction. Is it possible to propose a general malware detection process implementation platform that optimizes each process of existing malware detection methods while being able to efficiently extract various features on malware datasets with a large number of APK? To solve this problem, we propose an automated platform, AmandaSystem, that highly integrates the various processes of deep learning-based malware detection methods. At the same time, the problem of over privilege due to the openness of Android system and thus the problem of excessive privileges has always required the accurate construction of mapping relationships between privileges and API calls, while the current methods based on function call graphs suffer from inefficiency and low accuracy. To solve this problem, we propose a new bottom-up static analysis method based on AmandaSystem to achieve an efficient and complete tool for mapping relationships between Android permissions and API calls, PerApTool. Finally, we conducted tests on three publicly available malware datasets, CICMalAnal2017, CIC-AAGM2017, and CIC-InvesAndMal2019, to evaluate the performance of AmandaSystem in terms of time efficiency of APK parsing, space occupancy, and comprehensiveness of extracted features, respectively, compared with existing methods were compared.