AMD‐CNN: Android malware detection via feature graph and convolutional neural networks

Abstract

Summary Android malware has become a serious threat to mobile device users, and effective detection and defence architectures are needed to solve this problem. Recently, machine learning techniques have been widely used to deal with Android malicious apps. These methods are based on a simple feature set and have difficulty detecting up‐to‐date malware. Therefore, more robust and efficient classification methodologies are needed. In this article, AMD‐CNN, an Android malware detection tool, is proposed, and it uses graphical representations to detect malicious apks. In the first step, the features related to the androidmanifest.xml file are extracted and converted into a vector consisting of one or zero. The feature vector is then converted to 2D‐code images and used in training the CNN network. The model needs low‐resource consumption to run on mobile devices and allow real‐time applications to be analyzed. The experiments with 1920 malicious and benign apks show that the malware detection rate (accuracy) was 96.2% and precision, recall, and F‐score values were 97.9%, 98.2%, and 98.1%, respectively. The average time and memory space to analyze each application are 0.035 s and 3.38 MB. AMD‐CNN is an efficient and robust tool and has advantages over previous studies.

A malware detection system using a hybrid approach of multi-heads attention-based control flow traces and image visualization

“…Table 10 shows the performance comparisons with related and recently published research. Arslan et al [15] proposed to create a graphical Android malware detection tool. The features of Androidmanifest.xml are extracted and converted to a one-or-zero vector.…”

“…It has previously been demonstrated that CFG-based analysis can be combined with machine learning techniques to produce strong malware classification tools [4]. Arslan et al [15] suggested developing a graphical Android malware detection tool. A one-or-zero vector is extracted from the features of Androidmanifest.xml.…”

Z2F: Heterogeneous graph-based Android malware detection

“…In graph-based Android application detection, Marwan Omar [ 30 ] used his own graph convolutional neural network as a baseline, combined with expert data science methods, and finally achieved 99.183% accuracy in Android malware detection by continuously fine-tuning the model. RecepSinan Arslan [ 31 ] also uses a graph convolutional neural network, but the novelty is that it converts the data obtained in AndroidManifest.xml into image data and sends it to the neural network for learning, and its final accuracy rate reaches 96.2%. Shanxi Li [ 32 ] et al first extracted API call sequences from malware code and generated directed cyclic graphs, then used Markov chain and principal component analysis methods to extract feature maps of the graphs and designed a classifier based on graph convolutional networks, and finally achieved 98.32% accuracy.…”