Delving into Android Malware Families with a Novel Neural Projection Method

Abstract

Present research proposes the application of unsupervised and supervised machine-learning techniques to characterize Android malware families. More precisely, a novel unsupervised neural-projection method for dimensionality-reduction, namely, Beta Hebbian Learning (BHL), is applied to visually analyze such malware. Additionally, well-known supervised Decision Trees (DTs) are also applied for the first time in order to improve characterization of such families and compare the original features that are identified as the most important ones. The proposed techniques are validated when facing real-life Android malware data by means of the well-known and publicly available Malgenome dataset. Obtained results support the proposed approach, confirming the validity of BHL and DTs to gain deep knowledge on Android malware.

Android Malware Family Classification and Analysis: Current Status and Future Directions

“…In addition, other malware use an obfuscation technique or encrypted methods which cannot be read or decrypted unless the app is executed. A set of papers [28][29][30][31][32][33][34][35][36][37][38][39]42,[46][47][48]50,52,53,[55][56][57]59,62,63,[65][66][67] used static analysis. Details on the static features used by the papers were discussed in Section 4, Features.…”

“…A set of papers [33,34,48,52,55] uses features that are related to malware installation such as repackage and update, payload activation such as on booting and receiving calls, and privilege escalation attack such as asroot and exploid families [71]. Moreover, in [33,34,52], they include other features related to financial charges such as SMS and phone calls. Vega et al in [33,34], also include features related to personal information stealing such as phone number.…”

“…Moreover, in [33,34,52], they include other features related to financial charges such as SMS and phone calls. Vega et al in [33,34], also include features related to personal information stealing such as phone number.…”

Intrusion Detection with Unsupervised Techniques for Network Management Protocols over Smart Grids

“…More recently, a novel EPP algorithm, BHL, has been applied to Android malware families [33,34], obtaining much better results than other well-known algorithms.…”

“…BHL has also been previously employed in the analysis of the internal structure of a series of datasets [35,36], providing a clear projection of the original dataset. More specifically, it has been successfully applied to Android malware datasets [33,34], where its task was to characterize Android malware families. Therefore, this research aims to apply BHL to the datasets that have previously been used by MOVICAB-IDS, with the aim of improving the obtained projections and achieving a better visual representation of the network traffic.…”