Android malware detection via an app similarity graph

Frenklach, Tatiana; Cohen, Dvir; Shabtai, Asaf; Puzis, Rami

doi:10.1016/j.cose.2021.102386

Cited by 30 publications

(12 citation statements)

References 22 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The detection model achieves 98.98% accuracy. Frenklach et al [17] recommended a technique for examining static Android apps based on an app similarity graph (ASG). The key to categorizing an app's activity is found in its generic, reusable key components, such as functions, it is assumed.…”

Section: Comparison With Other Methodsmentioning

confidence: 99%

See 1 more Smart Citation

A malware detection system using a hybrid approach of multi-heads attention-based control flow traces and image visualization

2022

View full text Add to dashboard Cite

Android is the most widely used mobile platform, making it a prime target for malicious attacks. Therefore, it is imperative to effectively circumvent these attacks. Recently, machine learning has been a promising solution for malware detection, which relies on distinguishing features. While machine learning-based malware scanners have a large number of features, adversaries can avoid detection by using feature-related expertise. Therefore, one of the main tasks of the Android security industry is to consistently propose cutting-edge features that can detect suspicious activity. This study presents a novel feature representation approach for malware detection that combines API-Call Graphs (ACGs) with byte-level image representation. First, the reverse engineering procedure is used to obtain the Java programming codes and Dalvik Executable (DEX) file from Android Package Kit (APK). Second, to depict Android apps with high-level features, we develop ACGs by mining API-Calls and API sequences from Control Flow Graph (CFG). The ACGs can act as a digital fingerprint of the actions taken by Android apps. Next, the multi-head attention-based transfer learning method is used to extract trained features vector from ACGs. Third, the DEX file is converted to a malware image, and the texture features are extracted and highlighted using a combination of FAST (Features from Accelerated Segment Test) and BRIEF (Binary Robust Independent Elementary Features). Finally, the ACGs and texture features are combined for effective malware detection and classification. The proposed method uses a customized dataset prepared from the CIC-InvesAndMal2019 dataset and outperforms state-of-the-art methods with 99.27% accuracy.

show abstract

Section: Comparison With Other Methodsmentioning

confidence: 99%

“…The detection model has a 98.98% detection accuracy. Frenklach et al [17] suggested a method for analyzing static Android apps using an app similarity graph (ASG). It is assumed that the key to classifying an app's activity lies in its generic, reusable major components, such as its functions.…”

Section: Literature Reviewmentioning

confidence: 99%

A malware detection system using a hybrid approach of multi-heads attention-based control flow traces and image visualization

2022

View full text Add to dashboard Cite

show abstract

“…The experiments were run on an Intel(R) Xeon(R) CPU E5-2683 v4 2.1 GHz with 64 GB RAM with GeForce RTX 2080 TI GPU. The dataset for the experiments consisted of ∼73K benign apps from the Google Play Market [1] (obtained from Androzoo [85]) and ∼6K malicious apps from the Drebin dataset [86], [4], [5], [87], [88], [89], [90]. To account for variations in the dataset, a 5-fold CV was used.…”

Section: A Experimental Designmentioning

confidence: 99%

MaMaDroid2.0 -- The Holes of Control Flow Graphs

Berger¹,

Hajaj²,

Mariconti³

et al. 2022

Preprint

View full text Add to dashboard Cite

Android malware is a continuously expanding threat to billions of mobile users around the globe. Detection systems are updated constantly to address these threats. However, a backlash takes the form of evasion attacks, in which an adversary changes malicious samples such that those samples will be misclassified as benign. This paper fully inspects a well-known Android malware detection system, MaMaDroid, which analyzes the control flow graph of the application. Changes to the portion of benign samples in the train set and models are considered to see their effect on the classifier. The changes in the ratio between benign and malicious samples have a clear effect on each one of the models, resulting in a decrease of more than 40% in their detection rate. Moreover, adopted ML models are implemented as well, including 5-NN, Decision Tree, and Adaboost. Exploration of the six models reveals a typical behavior in different cases, of tree-based models and distance-based models. Moreover, three novel attacks that manipulate the CFG and their detection rates are described for each one of the targeted models. The attacks decrease the detection rate of most of the models to 0%, with regards to different ratios of benign to malicious apps. As a result, a new version of MaMaDroid is engineered. This model fuses the CFG of the app and static analysis of features of the app. This improved model is proved to be robust against evasion attacks targeting both CFG-based models and static analysis models, achieving a detection rate of more than 90% against each one of the attacks.

show abstract

“…In 2021 as well, Frenklach et al presented a static Android application analysis method that relied on an app similarity graph [20]. The proposed method was demonstrated on the Drebin benchmark in both balanced and unbalanced settings, on a brand new VTAz dataset from 2020, and on a dataset of approximately 190,000 applications provided by VirusTotal, achieving 0.975 accuracy in balanced settings and 0.987 area under the curve (AUC) score.…”

Section: B Machine Learning-based Malware Detectionmentioning

confidence: 99%

PAIRED: An Explainable Lightweight Android Malware Detection System

Alani

Awad

2022

IEEE Access

View full text Add to dashboard Cite

With approximately 2 billion active devices, the Android operating system tops all other operating systems in terms of the number of devices using it. Android has gained wide popularity not only as a smartphone operating system, but also as an operating system for vehicles, tablets, smart appliances, and Internet of Things devices. Consequently, security challenges have arisen with the rapid adoption of the Android operating system. Thousands of malicious applications have been created and are being downloaded by unsuspecting users. This paper presents a lightweight Android malware detection system based on explainable machine learning. The proposed system uses the features extracted from applications to identify malicious and benign malware. The proposed system is tested, showing an accuracy exceeding 98% while maintaining its small footprint on the device. In addition, the classifier model is explained using Shapley Additive Explanation (SHAP) values.

show abstract

Android malware detection via an app similarity graph

Cited by 30 publications

References 22 publications

A malware detection system using a hybrid approach of multi-heads attention-based control flow traces and image visualization

A malware detection system using a hybrid approach of multi-heads attention-based control flow traces and image visualization

MaMaDroid2.0 -- The Holes of Control Flow Graphs

PAIRED: An Explainable Lightweight Android Malware Detection System

Contact Info

Product

Resources

About