SEdroid: A Robust Android Malware Detector using Selective Ensemble Learning

Abstract

For the dramatic increase of Android malware and low efficiency of manual check process, deep learning methods started to be an auxiliary means for Android malware detection these years. However, these models are highly dependent on the quality of datasets, and perform unsatisfactory results when the quality of training data is not good enough. In the real world, the quality of datasets without manually check cannot be guaranteed, even Google Play may contain malicious applications, which will cause the trained model failure. To address the challenge, we propose a robust Android malware detection approach based on selective ensemble learning, trying to provide an effective solution not that limited to the quality of datasets. The proposed model utilizes genetic algorithm to help find the best combination of the component learners and improve robustness of the model. Our results show that the proposed approach achieves a more robust performance than other approaches in the same area. CCS CONCEPTS• Security and privacy → Software and application security;• Computing methodologies → Neural networks.

Deep Learning for Android Malware Defenses: a Systematic Literature Review

“…Except that, Qiu et al [131] divide malware into high impact and low impact based on impact ground truth of cyber-security or privacy impact, and propose a framework to predict the impact of Android malware. To maximize the detection performance, five studies apply various search techniques to explore the optimum parameters and DNN structures, including grid search [22,123], Tree-structured Parzen Estimator (TPE) [122], and genetic algorithms [105,170]. However, excellent detection performance doesn't necessarily mean promising effectiveness and reliability, because these methods merely provide classification results, which is not enough.…”

“…OPEN ISSUE Verifying the existence of certain categorical characteristics of Android applications, such as permissions/API calls by static analysis or certain malicious behaviors by dynamic analysis, is widely used to construct feature vectors [5,7,18,22,29,40,44,45,47,57,67,68,74,78,90,92,101,105,109,111,113,128,131,143,145,156,157,166,170,172,174,179,185,197,198,203,209]. The researchers usually build a look-up table to list all the potential features, based on prior knowledge or feature selection approaches, and a fixed-size binary feature vector is created to represent the feature information for each application.…”

“…Su et al [149,150] constructed a similar DBN-based Android malware detector but they used the learned feature representation by DBN to train an SVM classifier, which was proven good detection performance. SEdroid [170] introduced a genetic algorithm that leverages selective ensemble learning to further improve the detection model's generalization ability. Selective ensemble method was used to combine predictions by multiple DBN networks , and genetic algorithm was utilized to find the best combination of the component neural networks.…”

Tight Arms Race: Overview of Current Malware Threats and Trends in Their Detection

“…Unfortunately, to be efficiently deployed to production-quality scenarios, the bio-inspired methods require facing several problems, such as solving the imbalance of a dataset [125], tuning the configurations of neural network models [126], as well as finding the optimal combination of parameters while avoiding the problem of falling into local optimal solution [127]. However, GA algorithms demonstrated their capability for obtaining a strong generalization ability and robustness by finding the best learner group for ensemble models [128]. As a paradigmatic example of the use of bio-inspired approaches, in [129] the authors proposed a novel way for detecting code hidden with three commonly used steganographic tools via an Artificial Immune System.…”

Android Malware Detection Using Machine Learning with Feature Selection Based on the Genetic Algorithm

“…A. Meimandi et al [15] showed a performance improvement by combining genetic algorithm and the simulated annealing with classification algorithm. J. Wang et al [16] introduced SEdroid, an Android malware detector based on a genetic algorithm and ensemble learning. L. Wang et al [17] introduced a new algorithm based on the genetic algorithm for applications of Android malware classification problems.…”