Android malware detection method based on bytecode image

Ding, Yuxin; Zhang, Xiao; Hu, Jieke; Xu, Weipan

doi:10.1007/s12652-020-02196-4

Cited by 66 publications

(45 citation statements)

References 26 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Azab et al [ 42 ] proposed a malware spectrogram image classification framework that uses spectrogram images classified by CNN for malware detection. Ding et al [ 43 ] extracted bytecode from the Android package (APK) file and transformed it into a 2D bytecode matrix. Then, a CNN model was trained and used for malware recognition.…”

Section: Literature Surveymentioning

confidence: 99%

An Efficient DenseNet-Based Deep Learning Model for Malware Detection

Hemalatha¹,

Roseline

Geetha

et al. 2021

Entropy

172

View full text Add to dashboard Cite

Recently, there has been a huge rise in malware growth, which creates a significant security threat to organizations and individuals. Despite the incessant efforts of cybersecurity research to defend against malware threats, malware developers discover new ways to evade these defense techniques. Traditional static and dynamic analysis methods are ineffective in identifying new malware and pose high overhead in terms of memory and time. Typical machine learning approaches that train a classifier based on handcrafted features are also not sufficiently potent against these evasive techniques and require more efforts due to feature-engineering. Recent malware detectors indicate performance degradation due to class imbalance in malware datasets. To resolve these challenges, this work adopts a visualization-based method, where malware binaries are depicted as two-dimensional images and classified by a deep learning model. We propose an efficient malware detection system based on deep learning. The system uses a reweighted class-balanced loss function in the final classification layer of the DenseNet model to achieve significant performance improvements in classifying malware by handling imbalanced data issues. Comprehensive experiments performed on four benchmark malware datasets show that the proposed approach can detect new malware samples with higher accuracy (98.23% for the Malimg dataset, 98.46% for the BIG 2015 dataset, 98.21% for the MaleVis dataset, and 89.48% for the unseen Malicia dataset) and reduced false-positive rates when compared with conventional malware mitigation techniques while maintaining low computational time. The proposed malware detection solution is also reliable and effective against obfuscation attacks.

show abstract

Section: Literature Surveymentioning

confidence: 99%

An Efficient DenseNet-Based Deep Learning Model for Malware Detection

Hemalatha¹,

Roseline

Geetha

et al. 2021

Entropy

172

View full text Add to dashboard Cite

show abstract

“…The results with Support Vector Machines attain the highest accuracy of 92.7%. Authors in [15] transformed the dalvik executable code into two dimensional bytecode matrix. Further, convolutional neural network was used for training and classification task.…”

Section: Related Workmentioning

confidence: 99%

Classification and Analysis of Android Malware Images Using Feature Fusion Technique

et al. 2021

View full text Add to dashboard Cite

The super packed functionalities and artificial intelligence (AI)-powered applications have made the Android operating system a big player in the market. Android smartphones have become an integral part of life and users are reliant on their smart devices for making calls, sending text messages, navigation, games, and financial transactions to name a few. This evolution of the smartphone community has opened new horizons for malware developers. As malware variants are growing at a tremendous rate every year, there is an urgent need to combat against stealth malware techniques. This paper proposes a visualization and machine learning-based framework for classifying Android malware. Android malware applications from the DREBIN dataset were converted into grayscale images. In the first phase of the experiment, the proposed framework transforms Android malware into fifteen different image sections and identifies malware files by exploiting handcrafted features associated with Android malware images. The algorithms such as Gray Level Co-occurrence Matrix-based (GLCM), Global Image deScripTors (GIST), and Local Binary Pattern (LBP) are used to extract the handcrafted features from the image sections. The extracted features were further classified using machine learning algorithms like K-Nearest Neighbors, Support Vector Machines, and Random Forests. In the second phase of the experiment, handcrafted features were fused with CNN features to form the feature fusion strategy. The classification performance was evaluated against every malware image file section. The results obtained using the Feature Fusion strategy are compared with handcrafted features results. The experiment results conclude to the fact that Feature Fusion-SVM model is most suited for the identification and classification of Android malware using the certificate and Android Manifest (CR+AM) malware images. It attained an high accuracy of 93.24%.

show abstract

“…The DEX format provides a compact and optimized executable module [23]. The methods proposed by [24,25] make use of DEX bytecodes as images for malware detection and classification tasks. Figure 3 depicts grayscale images representing two benign Android applications and two Android malware instances.…”

Section: Chimera-rmentioning

confidence: 99%

“…images, and [25] introduced a CNN architecture for Android malware detection using DEX opcodes translated to RGB images. CNN is a class of DL network commonly applied to computer vision problems [15] and were inspired by the animal visual cortex.…”

Section: St Convmentioning

confidence: 99%

See 1 more Smart Citation

Chimera: An Android Malware Detection Method Based on Multimodal Deep Learning and Hybrid Analysis

Oliveira¹,

Sassi²

2020

Preprint

View full text Add to dashboard Cite

<div>The Android Operating System (OS) everywhere, computers, cars, homes, and, of course, personal and corporate smartphones. A recent survey from the International Data Corporation (IDC) reveals that the Android platform holds 85% of the smartphone market share. Its popularity and open nature make it an attractive target for malware. According to AV-TEST, by November 2020, 2.87M new Android malware instances were identified in the wild. Malware detection is a challenging problem that has been actively explored by both the industry and academia using intelligent methods. On the one hand, traditional machine learning (ML) malware detection methods rely on manual feature engineering that requires expert knowledge. On the other hand, deep learning (DL) malware detection methods perform automatic feature extraction but usually require much more data and processing power. In this work, we propose a new multimodal DL Android malware detection method, Chimera, that combines both manual and automatic feature engineering by using the DL architectures, Convolutional Neural Networks (CNN), Deep Neural Networks (DNN), and Transformer Networks (TN) to perform feature learning from raw data (Dalvik Executable (DEX) grayscale images), static analysis data (Android Intents & Permissions), and dynamic analysis data (system call sequences) respectively. To train and evaluate our model, we implemented the Knowledge Discovery in Databases (KDD) process and used the publicly available Android benchmark dataset Omnidroid, which contains static and dynamic analysis data extracted from 22,000 real malware and goodware samples. By leveraging a hybrid source of information to learn high-level feature representations for both the static and dynamic properties of Android applications, Chimera’s detection Accuracy, Precision, Recall, and ROC AUC outperform classical ML algorithms, state-of-the-art Ensemble, and Voting Ensembles ML methods, as well as unimodal DL methods using CNNs, DNNs, TNs, and Long-Short Term Memory Networks (LSTM). To the best of our knowledge, this is the first work that successfully applies multimodal DL to combine those three different modalities of data using DNNs, CNNs, and TNs to learn a shared representation that can be used in Android malware detection tasks.</div>

show abstract

Android malware detection method based on bytecode image

Cited by 66 publications

References 26 publications

An Efficient DenseNet-Based Deep Learning Model for Malware Detection

An Efficient DenseNet-Based Deep Learning Model for Malware Detection

Classification and Analysis of Android Malware Images Using Feature Fusion Technique

Chimera: An Android Malware Detection Method Based on Multimodal Deep Learning and Hybrid Analysis

Contact Info

Product

Resources

About