An ML-Based Recognizer of Exfiltration Attack over Android Platform: MLGuard

Abstract

<p>As Android smartphones continue to rise in popularity, the number of malicious programs targeting the platform has increased dramatically. Methods for efficiently detecting and preventing the spread of Android malware have become a subject of increasing urgency. The exfiltration of sensitive data from smartphones is one of the sophisticated security threats that need to be addressed. In this paper, we analyzed the 3-grams of system calls, and developed a framework for identifying malicious Android applications that engage in network data exfiltration. Androzoo, a recently made public database, serves as the foundation for our exfiltration dataset. The majority of published works rely on data acquired from Android emulators and user input simulation. As part of our research, we collect data on the behavior of exfiltration attempts only in real-world interaction, as opposed to data from emulators or virtual environments. Using these dynamic variables, we employ cutting-edge machine learning and deep learning classifiers, including Random Forest and deep neural network. It obtains an exfiltration detection accuracy of 98.9 percent using 20s time windows for detection. In addition, we applied our trained model on Android phones and attained minimal latency and high detection accuracy for unknown exfiltration applications.</p>

A Proposed Artificial Intelligence Model for Android-Malware Detection

“…Because of this, we describe a novel method called FeVec, which uses automated feature vector representation to identify malware samples. The FeVec method utilizes feature hashing [67] and an NLP bag of words (N-grams) [68][69][70][71] to form fixed-size embeddings from concatenated instruction sequences. This step consists of two main steps.…”

“…Precision, accuracy, F1-score and recall are used to display the evaluation results. We evaluate the efficiency of family clustering using the coverage and homogeneity [71] measures. The generated family clusters are evaluated on their degree of purity using the homogeneity metric.…”