Permission Sensitivity-Based Malicious Application Detection for Android

Abstract

Since a growing number of malicious applications attempt to steal users’ private data by illegally invoking permissions, application stores have carried out many malware detection methods based on application permissions. However, most of them ignore specific permission combinations and application categories that affect the detection accuracy. The features they extracted are neither representative enough to distinguish benign and malicious applications. For these problems, an Android malware detection method based on permission sensitivity is proposed. First, for each kind of application categories, the permission features and permission combination features are extracted. The sensitive permission feature set corresponding to each category label is then obtained by the feature selection method based on permission sensitivity. In the following step, the permission call situation of the application to be detected is compared with the sensitive permission feature set, and the weight allocation method is used to quantify this information into numerical features. In the proposed method of malicious application detection, three machine-learning algorithms are selected to construct the classifier model and optimize the parameters. Compared with traditional methods, the proposed method consumed 60.94% less time while still achieving high accuracy of up to 92.17%.

Privacy preservation for federated learning based on Gaussian noise scrambling

“…With the further development of federated learning, issues related to federated learning privacy protection have gradually attracted people's attention. Among them, secure multi-party computing [5] was first introduced as a means. Aono [6] discussed the possibility of information leakage caused by the communication between the central server and the client.…”

Decentralized federated learning privacy protection aggregation

“…However, existing federated learning has the problem of a unique model, where all participants upload their local model parameters to the central server and aggregate them into the same model. In different real-world scenarios, data often has different features and distributions, and there is no universal model suitable for learning data from multiple scenarios [3][4][5] . In addition, existing federated learning is a centralized structure that relies entirely on the reliability of the central server, which also poses significant security risks [6][7][8].…”

Intelligent Association of CVE Vulnerabilities Based on Chain Reasoning

“…A large amount of existing vulnerability information is provided by vulnerability databases, open-source communities, security blogs, forums, etc. Although this can provide convenience for network security researchers to conduct vulnerability analysis and systematically study vulnerability mechanisms and vulnerability content, each vulnerability database is managed in a decentralized manner [5]. It is relatively difficult to integrate different vulnerability information [6].…”