Towards an interpretable deep learning model for mobile malware detection and family identification

Iadarola, Giacomo; Martinelli, Fabio; Mercaldo, Francesco; Santone, Antonella

doi:10.1016/j.cose.2021.102198

Cited by 74 publications

(30 citation statements)

References 17 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Malware samples were collected from the AMD and previous work datasets [17], and the benign samples were downloaded from Google Play. Both the mal- 1.…”

Section: Methodsmentioning

confidence: 99%

Robust Malware Classification via Deep Graph Networks on Call Graph Topologies

Errica¹,

Iadarola²,

Martinelli³

et al. 2021

ESANN 2021 Proceedings

Self Cite

View full text Add to dashboard Cite

We propose a malware classification system that is shown to be robust to some common intra-procedural obfuscation techniques. Indeed, by training the Contextual Graph Markov Model on the call graph representation of a program, we classify it using only topological information, which is unaffected by such obfuscations. In particular, we show that the structure of the call graph is sufficient to achieve good accuracy on a multi-class classification benchmark.

show abstract

“…Malware samples were collected from the AMD and previous work datasets [17], and the benign samples were downloaded from Google Play. Both the mal- 1.…”

Section: Methodsmentioning

confidence: 99%

Robust Malware Classification via Deep Graph Networks on Call Graph Topologies

Errica¹,

Iadarola²,

Martinelli³

et al. 2021

ESANN 2021 Proceedings

Self Cite

View full text Add to dashboard Cite

show abstract

“…The proposed method allows various classification models to be flexibly applied depending on the purpose by constructing detecting attacks with multiple classification models. In addition, the first phase is performed independently of the second step of performing noise reduction, and this configuration improves the compatibility of the entire system [30].…”

Section: Online Data Collection and Attack Detection Using Ensemble M...mentioning

confidence: 99%

A Study on High-Speed Outlier Detection Method of Network Abnormal Behavior Data Using Heterogeneous Multiple Classifiers

2022

View full text Add to dashboard Cite

As the complexity and scale of the network environment increase continuously, various methods to detect attacks and intrusions from network traffic by classifying normal and abnormal network behaviors show their limitations. The number of network traffic signatures is increasing exponentially to the extent that semi-realtime detection is not possible. However, machine learning-based intrusion detection only gives simple guidelines as simple contents of security events. This is why security data for a specific environment cannot be configured due to data noise, diversification, and continuous alteration of a system and network environments. Although machine learning is performed and evaluated using a generalized data set, its performance is expected to be similar in that specific network environment only. In this study, we propose a high-speed outlier detection method for a network dataset to customize the dataset in real-time for a continuously changing network environment. The proposed method uses an ensemble-based noise data filtering model using the voting results of 6 classifiers (decision tree, random forest, support vector machine, naive Bayes, k-nearest neighbors, and logistic regression) to reflect the distribution and various environmental characteristics of datasets. Moreover, to prove the performance of the proposed method, we experimented with the accuracy of attack detection by gradually reducing the noise data in the time series dataset. As a result of the experiment, the proposed method maintains a training dataset of a size capable of semi-real-time learning, which is 10% of the total training dataset, and at the same time, shows the same level of accuracy as a detection model using a large training dataset. The improved research results would be the basis for automatic tuning of network datasets and machine learning that can be applied to special-purpose environments and devices such as ICS environments.

show abstract

“…MalDozer [16] is a tool aimed at Android malware detection and family identification by analyzing API method calls. Furthermore, the study in [17] proposes a malware detector focused on the Android environment, aimed to discriminate between malicious and legitimate samples and to identify malware belonging to the family.…”

Section: Deep Learning-based Malware Detection Techniquesmentioning

confidence: 99%

Detection of Malicious Software by Analyzing Distinct Artifacts Using Machine Learning and Deep Learning Algorithms

Mathew¹,

Jyothish²,

Anandaram³

et al. 2021

Electronics

Self Cite

View full text Add to dashboard Cite

Malware is one of the most significant threats in today’s computing world since the number of websites distributing malware is increasing at a rapid rate. Malware analysis and prevention methods are increasingly becoming necessary for computer systems connected to the Internet. This software exploits the system’s vulnerabilities to steal valuable information without the user’s knowledge, and stealthily send it to remote servers controlled by attackers. Traditionally, anti-malware products use signatures for detecting known malware. However, the signature-based method does not scale in detecting obfuscated and packed malware. Considering that the cause of a problem is often best understood by studying the structural aspects of a program like the mnemonics, instruction opcode, API Call, etc. In this paper, we investigate the relevance of the features of unpacked malicious and benign executables like mnemonics, instruction opcodes, and API to identify a feature that classifies the executable. Prominent features are extracted using Minimum Redundancy and Maximum Relevance (mRMR) and Analysis of Variance (ANOVA). Experiments were conducted on four datasets using machine learning and deep learning approaches such as Support Vector Machine (SVM), Naïve Bayes, J48, Random Forest (RF), and XGBoost. In addition, we also evaluate the performance of the collection of deep neural networks like Deep Dense network, One-Dimensional Convolutional Neural Network (1D-CNN), and CNN-LSTM in classifying unknown samples, and we observed promising results using APIs and system calls. On combining APIs/system calls with static features, a marginal performance improvement was attained comparing models trained only on dynamic features. Moreover, to improve accuracy, we implemented our solution using distinct deep learning methods and demonstrated a fine-tuned deep neural network that resulted in an F1-score of 99.1% and 98.48% on Dataset-2 and Dataset-3, respectively.

show abstract

Towards an interpretable deep learning model for mobile malware detection and family identification

Cited by 74 publications

References 17 publications

Robust Malware Classification via Deep Graph Networks on Call Graph Topologies

Robust Malware Classification via Deep Graph Networks on Call Graph Topologies

A Study on High-Speed Outlier Detection Method of Network Abnormal Behavior Data Using Heterogeneous Multiple Classifiers

Detection of Malicious Software by Analyzing Distinct Artifacts Using Machine Learning and Deep Learning Algorithms

Contact Info

Product

Resources

About