MalScan: Fast Market-Wide Mobile Malware Scanning by Social-Network Centrality Analysis

Wu, Yueming; Li, Xiaodi; Zou, Deqing; Yang, Wei; Zhang, Xin; Jin, Hai

doi:10.1109/ase.2019.00023

Cited by 39 publications

(24 citation statements)

References 33 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…-DroidCat, which was published in the TIFS journal in 2019 by Cai et al (2019) and has collected more than 30 citations. -MalScan, the most recent identified approach, which has been presented at ASE in 2019 by Wu et al (2019).…”

Section: This Papermentioning

confidence: 99%

“…We now describe our journey to reproduce five approaches identified from the literature. First, we present the selection criteria, which eventually led to the identification of DREBIN (Arp et al 2014), MaMaDroid (Mariconti et al 2017), RevealDroid (Garcia et al 2018), DroidCat (Cai et al 2019), and MalScan (Wu et al 2019). Then, for each reproduction subject, we (1) introduce the approach, (2) describe how we reproduce the building blocks of the machine learning approach, and (3) quantitatively compare the results obtained based on our reproduction against the results presented in the original publication.…”

Section: Reproductionmentioning

confidence: 99%

See 1 more Smart Citation

Lessons Learnt on Reproducibility in Machine Learning Based Android Malware Detection

et al. 2021

View full text Add to dashboard Cite

A well-known curse of computer security research is that it often produces systems that, while technically sound, fail operationally. To overcome this curse, the community generally seeks to assess proposed systems under a variety of settings in order to make explicit every potential bias. In this respect, recently, research achievements on machine learning based malware detection are being considered for thorough evaluation by the community. Such an effort of comprehensive evaluation supposes first and foremost the possibility to perform an independent reproduction study in order to sharpen evaluations presented by approaches’ authors. The question Can published approaches actually be reproduced? thus becomes paramount despite the little interest such mundane and practical aspects seem to attract in the malware detection field. In this paper, we attempt a complete reproduction of five Android Malware Detectors from the literature and discuss to what extent they are “reproducible”. Notably, we provide insights on the implications around the guesswork that may be required to finalise a working implementation. Finally, we discuss how barriers to reproduction could be lifted, and how the malware detection field would benefit from stronger reproducibility standards—like many various fields already have.

show abstract

Section: This Papermentioning

confidence: 99%

Section: Reproductionmentioning

confidence: 99%

Lessons Learnt on Reproducibility in Machine Learning Based Android Malware Detection

et al. 2021

View full text Add to dashboard Cite

show abstract

“…Therefore, they were not used as a whole in many works [23] [39] [16]. Of such works, [39] use centrality measures of API methods, while [16] use graphlet frequency distribution as the feature vectors. Classifiers were trained with these feature vectors to detect Android malware.…”

Section: Related Workmentioning

confidence: 99%

Heterogeneous Graph Convolutional Networks for Android Malware Detection using Callback-Aware Caller-Callee Graphs

Vinayaka¹,

Jaidhar²

2021

Preprint

View full text Add to dashboard Cite

<pre> The popularity of the Android Operating System in the smartphone market has given rise to lots of Android malware. To accurately detect these malware, many of the existing works use machine learning and deep learning-based methods, in which feature extraction methods were used to extract fixed-size feature vectors using the files present inside the Android Application Package (APK). Recently, Graph Convolutional Network (GCN) based methods applied on the Function Call Graph (FCG) extracted from the APK are gaining momentum in Android malware detection, as GCNs are effective at learning tasks on variable-sized graphs such as FCG, and FCG sufficiently captures the structure and behaviour of an APK. However, the FCG lacks information about callback methods as the Android Application Programming Interface (API) is event-driven. This paper proposes enhancing the FCG to eFCG (enhanced-FCG) using the callback information extracted using Android Framework Space Analysis to overcome this limitation. Further, we add permission - API method relationships to the eFCG. The eFCG is reduced using node contraction based on the classes to get R-eFCG (Reduced eFCG) to improve the generalisation ability of the Android malware detection model. The eFCG and R-eFCG are then given as the inputs to the Heterogeneous GCN models to determine whether the APK file from which they are extracted is malicious or not. To test the effectiveness of eFCG and R-eFCG, we conducted an ablation study by removing their various components. To determine the optimal neighbourhood size for GCN, we experimented with a varying number of GCN layers and found that the Android malware detection model using R-eFCG with all its components with four convolution layers achieved maximum accuracy of 96.28%.</pre>

show abstract

“…Androguard can be used both as a command line tool and an imported package for python scripts. A large portion of Android malware detection systems incorporate Androguard [3,4,14,19,26,27,38,48,39,69,72,80,84,96,100,101,103,122,124,136,137,142,143]. When analyzing an APK, Androguard efficiently extracts features such as API calls, CFG graph, permissions, Activities, Package names, etc.…”

Section: Androguardmentioning

confidence: 99%

When the Guard failed the Droid: A case study of Android malware

Berger¹,

Hajaj²,

Dvir³

2020

Preprint

View full text Add to dashboard Cite

Android malware is a persistent threat to billions of users around the world. As a countermeasure, Android malware detection systems are occasionally implemented. However, these systems are often vulnerable to evasion attacks, in which an adversary manipulates malicious instances so that they are misidentified as benign. In this paper, we launch various innovative evasion attacks against several Android malware detection systems. The vulnerability inherent to all of these systems is that they are part of Androguard [34], a popular open source library used in Android malware detection systems. Some of the detection systems decrease to a 0% detection rate after the attack. Therefore, the use of open source libraries in malware detection systems calls for caution.In addition, we present a novel evaluation scheme for evasion attack generation that exploits the weak spots of known Android malware detection systems. In so doing, we evaluate the functionality and maliciousness of the manipulated instances created by our evasion attacks. We found variations in both the maliciousness and functionality tests of our manipulated apps. We show that non-functional apps, while considered malicious, do not threaten users and are thus useless from an attacker's point of view. We conclude that evasion attacks must be assessed for both functionality and maliciousness to evaluate their impact, a step which is far from commonplace today.

show abstract

MalScan: Fast Market-Wide Mobile Malware Scanning by Social-Network Centrality Analysis

Cited by 39 publications

References 33 publications

Lessons Learnt on Reproducibility in Machine Learning Based Android Malware Detection

Lessons Learnt on Reproducibility in Machine Learning Based Android Malware Detection

Heterogeneous Graph Convolutional Networks for Android Malware Detection using Callback-Aware Caller-Callee Graphs

When the Guard failed the Droid: A case study of Android malware

Contact Info

Product

Resources

About