Malware Detection by Eating a Whole APK

Al-Fawa’reh, Mohammad; Saif, Amal; Jafar, Mousa Tayseer; Elhassan, Ammar

doi:10.23919/icitst51030.2020.9351333

Cited by 20 publications

(16 citation statements)

References 13 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…They used a CNN model, which has a precision of 98.3%, to classify malware without relying on any special features. In [ 22 , 24 , 41 , 42 ] CNN and TCN models were used to classify malware with texture features. The proposed deep learning models directly collect the malware images for classification without selecting the special features using descriptors.…”

Section: Resultsmentioning

confidence: 99%

Cyber-Threat Detection System Using a Hybrid Approach of Transfer Learning and Multi-Model Image Representation

Ullah

Naeem

et al. 2022

Sensors

View full text Add to dashboard Cite

Currently, Android apps are easily targeted by malicious network traffic because of their constant network access. These threats have the potential to steal vital information and disrupt the commerce, social system, and banking markets. In this paper, we present a malware detection system based on word2vec-based transfer learning and multi-model image representation. The proposed method combines the textual and texture features of network traffic to leverage the advantages of both types. Initially, the transfer learning method is used to extract trained vocab from network traffic. Then, the malware-to-image algorithm visualizes network bytes for visual analysis of data traffic. Next, the texture features are extracted from malware images using a combination of scale-invariant feature transforms (SIFTs) and oriented fast and rotated brief transforms (ORBs). Moreover, a convolutional neural network (CNN) is designed to extract deep features from a set of trained vocab and texture features. Finally, an ensemble model is designed to classify and detect malware based on the combination of textual and texture features. The proposed method is tested using two standard datasets, CIC-AAGM2017 and CICMalDroid 2020, which comprise a total of 10.2K malware and 3.2K benign samples. Furthermore, an explainable AI experiment is performed to interpret the proposed approach.

show abstract

Section: Resultsmentioning

confidence: 99%

Cyber-Threat Detection System Using a Hybrid Approach of Transfer Learning and Multi-Model Image Representation

Ullah

Naeem

et al. 2022

Sensors

View full text Add to dashboard Cite

show abstract

“…Currently, significant research has been conducted on CNN-based image processing of Android code and the subsequent analysis [42], and most studies involving sequence formats used significantly common features. In this study, we used migration learning to migrate the source code comments to the original uncommented malicious Android code.…”

Section: Model Designmentioning

confidence: 99%

Android-SEM: Generative Adversarial Network for Android Malware Semantic Enhancement Model Based on Transfer Learning

Huang¹,

Li²,

Qiao³

et al. 2022

Electronics

View full text Add to dashboard Cite

Currently, among the millions of Android applications, there exist numerous malicious programs that pose significant threats to people’s security and privacy. Therefore, it is imperative to develop approaches for detecting Android malware. Recently developed malware detection methods usually rely on various features, such as application programming interface (API) sequences, images, and permissions, thereby ignoring the importance of source code and the associated comments, which are not usually included in malware. Therefore, we propose Android-SEM, which is an Android source code semantic enhancement model based on transfer learning. Our proposed model is built upon the Transformer architecture to achieve a pretraining framework for generating code comments from malware source code. The performance of the pretraining framework is optimized using a generative adversarial network. Our proposed model relies on a novel regression model-based filter to retain high-quality comments and source code for feature fusion pertinent to semantic enhancement. Creatively, and contrary to conventional methods, we incorporated a quantum support vector machine (QSVM) for classifying malicious Android code by combining quantum machine learning and classical deep learning models. The results proved that Android-SEM achieves accuracy levels of 99.55% and 99.01% for malware detection and malware categorization, respectively.

show abstract

“…Al-Fawa'reh et al [25] introduced a convolutional neural-network-based approach for malware detection using hacked Android package files (APKs). By leveraging different sets of balanced and unbalanced datasets from those created by [24], the authors showed that their method was highly accurate at detecting malware, with an overall accuracy of 96.4%.…”

Section: Plos Onementioning

confidence: 99%

“…The proposed model was compared with those of recent studies [24][25][26]. The previous experiments used the same dataset with the different models listed in Table 13.…”

Section: Comparison Of the Same Dataset With Other Workmentioning

confidence: 99%

Android malware classification based on random vector functional link and artificial Jellyfish Search optimizer

2021

View full text Add to dashboard Cite

Smartphone usage is nearly ubiquitous worldwide, and Android provides the leading open-source operating system, retaining the most significant market share and active user population of all open-source operating systems. Hence, malicious actors target the Android operating system to capitalize on this consumer reliance and vulnerabilities present in the system. Hackers often use confidential user data to exploit users for advertising, extortion, and theft. Notably, most Android malware detection tools depend on conventional machine-learning algorithms; hence, they lose the benefits of metaheuristic optimization. Here, we introduce a novel detection system based on optimizing the random vector functional link (RVFL) using the artificial Jellyfish Search (JS) optimizer following dimensional reduction of Android application features. JS is used to determine the optimal configurations of RVFL to improve classification performance. RVFL+JS minimizes the runtime of the execution of the optimized models with the best performance metrics, based on a dataset consisting of 11,598 multi-class applications and 471 static and dynamic features.

show abstract

Malware Detection by Eating a Whole APK

Cited by 20 publications

References 13 publications

Cyber-Threat Detection System Using a Hybrid Approach of Transfer Learning and Multi-Model Image Representation

Cyber-Threat Detection System Using a Hybrid Approach of Transfer Learning and Multi-Model Image Representation

Android-SEM: Generative Adversarial Network for Android Malware Semantic Enhancement Model Based on Transfer Learning

Android malware classification based on random vector functional link and artificial Jellyfish Search optimizer

Contact Info

Product

Resources

About