Deep4MalDroid: A Deep Learning Framework for Android Malware Detection Based on Linux Kernel System Call Graphs

Hou, Shifu; Saas, Aaron; Chen, Lifei; Ye, Yanfang

doi:10.1109/wiw.2016.040

Cited by 181 publications

(92 citation statements)

References 16 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…( Yuan et al, 2016 ) in all other metrics, while utilizing more samples for the experiments. DL-Droid also outperforms Maldozer ( Karbab et al, 2017 ), Deep4MalDroid ( Hou et al, 2016 ), AutoDroid ( Hou et al, 2017 ) and the CNN approach presented in ( McLaughlin et al, 2017 ). It is interesting to note that, just like in Deep4MalDroid and Auto-Droid, the number of the optimum hidden layers for DL-Droid is three.…”

Section: Comparison Of the Performance Of The Deep Learning Classifiementioning

confidence: 89%

DL-Droid: Deep learning based android malware detection using real devices

Alzaylaee

Yerima

Sezer

2020

Computers & Security

316

141

View full text Add to dashboard Cite

a b s t r a c tThe Android operating system has been the most popular for smartphones and tablets since 2012. This popularity has led to a rapid raise of Android malware in recent years. The sophistication of Android malware obfuscation and detection avoidance methods have significantly improved, making many traditional malware detection methods obsolete. In this paper, we propose DL-Droid, a deep learning system to detect malicious Android applications through dynamic analysis using stateful input generation. Experiments performed with over 30,0 0 0 applications (benign and malware) on real devices are presented. Furthermore, experiments were also conducted to compare the detection performance and code coverage of the stateful input generation method with the commonly used stateless approach using the deep learning system. Our study reveals that DL-Droid can achieve up to 97.8% detection rate (with dynamic features only) and 99.6% detection rate (with dynamic + static features) respectively which outperforms traditional machine learning techniques. Furthermore, the results highlight the significance of enhanced input generation for dynamic analysis as DL-Droid with the state-based input generation is shown to outperform the existing state-of-the-art approaches.

show abstract

Section: Comparison Of the Performance Of The Deep Learning Classifiementioning

confidence: 89%

DL-Droid: Deep learning based android malware detection using real devices

Alzaylaee

Yerima

Sezer

2020

Computers & Security

316

141

View full text Add to dashboard Cite

show abstract

“…The work by Hou et al [3] outlines their commercial Android malware detection framework, Deep4MalDroid. Their method involves the use of stacked auto-encoders with best accuracy resulting from 3 layers.…”

Section: Existing Workmentioning

confidence: 99%

“…This is an advanced subset of machine learning, which can overcome some of the limitations of shallow learning. Thus far, initial deep learning research has demonstrated that its superior layer-wise feature learning can better or at least match the performance of shallow learning techniques [3]. It is capable of facilitating a deeper analysis of network data and faster identification of any anomalies.…”

Section: Introductionmentioning

confidence: 99%

A Deep Learning Approach to Network Intrusion Detection

Shone

Ngoc

Phai

et al. 2018

IEEE Trans. Emerg. Top. Comput. Intell.

1,161

481

View full text Add to dashboard Cite

Abstract-Network Intrusion Detection Systems (NIDSs) play a crucial role in defending computer networks. However, there are concerns regarding the feasibility and sustainability of current approaches when faced with the demands of modern networks. More specifically, these concerns relate to the increasing levels of required human interaction and the decreasing levels of detection accuracy. This paper presents a novel deep learning technique for intrusion detection, which addresses these concerns. We detail our proposed non-symmetric deep auto-encoder (NDAE) for unsupervised feature learning. Furthermore, we also propose our novel deep learning classification model constructed using stacked NDAEs. Our proposed classifier has been implemented in GPU-enabled TensorFlow and evaluated using the benchmark KDD Cup '99 and NSL-KDD datasets. Promising results have been obtained from our model thus far, demonstrating improvements over existing approaches and the strong potential for use in modern NIDSs.

show abstract

“…Finally, the constructed vectors were used to train a multilayered neural network which has been used in applications classification. In [116], a dynamic analysis framework has been developed to detect the apps' malicious behaviour. The proposed method is based on a deep learning architecture with Stacked AutoEncoders (SAEs) in order to classify android apps as malicious or benign.…”

Section: Clustering Algorithms This Type Of Algorithms Ismentioning

confidence: 99%

“…The proposed tool has been tested by building a decision model based on a variety of machine learning algorithms and the obtained results have been compared with the results of some other tools. In [116], a dynamic analysis tool named Component Traversal has been proposed in order to automatically execute the code of each given Android application as completely as possible. It has been stated that the proposed Component Traversal tool outperform the MonkeyRunner tool in term of system calls extraction.…”

Section: User Interface Triggering Toolsmentioning

confidence: 99%

The Android malware detection systems between hope and reality

2019

View full text Add to dashboard Cite

The widespread use of Android-based smartphones made it an important target for malicious applications' developers. So, a large number of frameworks have been proposed to tackle the huge number of daily published malwares. Despite there are many review papers that have been conducted in order to shed light on the works that achieved in Android malware analysing domain, the number of conducted review papers do not fit with the importance of this research field and with the volume of achieved works. Also, there is no comprehensive taxonomy for all research trends in the field of analysing malicious applications targeting the Android system. Furthermore, none of the existing review papers contains a schematic model that makes it easy for the reader to know the methods and methodologies used in a particular field of research without much effort. This paper aims at proposing a comprehensive taxonomy and suggesting a new schematic review approach. To this end, a review of a large number of works that achieved between 2009 and 2019 has been conducted. The achieved study includes more than 200 papers that have different goals such as apps' behaviour analysis, automatic user interface triggers or packer/unpacker frameworks development. Also, a comprehensive taxonomy has been proposed so that most of the previous works can be classified under it. To the best of our knowledge, the suggested taxonomy is the widest and the most comprehensive in terms of the covered research trends. Moreover, we have proposed a detailed schematic model (called Schematic Review Model) illustrates the process of detecting the malignant applications of an Android in the light of the studied works and the proposed taxonomy. To our knowledge, this is the first time that the Android malware detection methods have been explained in this way with this amount of detail. Furthermore, the studied researches have been analysed according to multiple criteria such as used analysing method, used features, used detection method, and used dataset. Also, the features used in the studied works were discussed in detail by dividing it into multiple classes. Moreover, the challenges facing Android's malware analysing methods were discussed in detail. Finally, it has been concluded that there are gaps between the size and the goal of the conducted works and the number of malicious apps published every day, so some future works areas have been proposed and discussed.

show abstract

Deep4MalDroid: A Deep Learning Framework for Android Malware Detection Based on Linux Kernel System Call Graphs

Cited by 181 publications

References 16 publications

DL-Droid: Deep learning based android malware detection using real devices

DL-Droid: Deep learning based android malware detection using real devices

A Deep Learning Approach to Network Intrusion Detection

The Android malware detection systems between hope and reality

Contact Info

Product

Resources

About