DroidClassifier: Efficient Adaptive Mining of Application-Layer Header for Classifying Android Malware

Li, Zhiqiang; Sun, Lichao; Yan, Qiben; Srisa-an, Witawas; Chen, Zhenxiang

doi:10.1007/978-3-319-59608-2_33

Cited by 29 publications

(16 citation statements)

References 26 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In comparison, dynamic feature analysis rely on behavior detection at runtime. Specifically, [5], [6] extract Linux kernel system calls from Apps executed in Genymotion (Android Virtual Machine) while log analysis [7], [40] and traffic analysis [8], [41] facilitate to capture Apps' real-world behavior. However, it is timeconsuming and unrealistic to be applied in malware detection at scale.…”

Section: Related Workmentioning

confidence: 99%

Hawk: Rapid Android Malware Detection Through Heterogeneous Graph Attention Networks

Hei

Yang

Peng³

et al. 2024

IEEE Trans. Neural Netw. Learning Syst.

Self Cite

View full text Add to dashboard Cite

Android is undergoing unprecedented malicious threats daily, but the existing methods for malware detection often fail to cope with evolving camouflage in malware. To address this issue, we present HAWK, a new malware detection framework for evolutionary Android applications. We model Android entities and behavioural relationships as a heterogeneous information network (HIN), exploiting its rich semantic metastructures for specifying implicit higher-order relationships. An incremental learning model is created to handle the applications that manifest dynamically, without the need for re-constructing the whole HIN and the subsequent embedding model. The model can pinpoint rapidly the proximity between a new application and existing in-sample applications and aggregate their numerical embeddings under various semantics. Our experiments examine more than 80,860 malicious and 100,375 benign applications developed over a period of seven years, showing that HAWK achieves the highest detection accuracy against baselines and takes only 3.5ms on average to detect an out-of-sample application, with the accelerated training time of 50x faster than the existing approach.

show abstract

Section: Related Workmentioning

confidence: 99%

Hawk: Rapid Android Malware Detection Through Heterogeneous Graph Attention Networks

Hei

Yang

Peng³

et al. 2024

IEEE Trans. Neural Netw. Learning Syst.

Self Cite

View full text Add to dashboard Cite

show abstract

“…Li et al . [14] suggested a system called DroidClassifier, to characterise the network traffic created by mobile malware. The DroidClassifier identifies distinguishable malware patterns by considering multidimensional network traffic.…”

Section: Literature Reviewmentioning

confidence: 99%

Improved real‐time permission based malware detection and clustering approach using model independent pruning

Thiyagarajan

Akash

Murugan

2020

IET Information Security

View full text Add to dashboard Cite

“…Li et al presented a framework for detection and classification of network traffic of malicious Android application [19]. It is based on analysis of the HTTP protocol and organized into 3 components: training module, clustering module, and malware classification and detection module.…”

Section: Related Workmentioning

confidence: 99%

Characterizing Anomalies in Malware-Generated HTTP Traffic

Białczak

Mazurczyk

2020

Security and Communication Networks

View full text Add to dashboard Cite

Currently, we are witnessing a significant rise in various types of malware, which has an impact not only on companies, institutions, and individuals, but also on entire countries and societies. Malicious software developers try to devise increasingly sophisticated ways to perform nefarious actions. In consequence, the security community is under pressure to develop more effective defensive solutions and to continuously improve them. To accomplish this, the defenders must understand and be able to recognize the threat when it appears. That is why, in this paper, a large dataset of recent real-life malware samples was used to identify anomalies in the HTTP traffic produced by the malicious software. The authors analyzed malware-generated HTTP requests, as well as benign traffic of the popular web browsers, using 3 groups of features related to the structure of requests, header field values, and payload characteristics. It was observed that certain attributes of the HTTP traffic can serve as an indicator of malicious actions, including lack of some popular HTTP headers and their values or usage of the protocol features in an uncommon way. The findings of this paper can be conveniently incorporated into the existing detection systems and network traffic forensic tools, making it easier to spot and eliminate potential threats.

show abstract

DroidClassifier: Efficient Adaptive Mining of Application-Layer Header for Classifying Android Malware

Cited by 29 publications

References 26 publications

Hawk: Rapid Android Malware Detection Through Heterogeneous Graph Attention Networks

Hawk: Rapid Android Malware Detection Through Heterogeneous Graph Attention Networks

Improved real‐time permission based malware detection and clustering approach using model independent pruning

Characterizing Anomalies in Malware-Generated HTTP Traffic

Contact Info

Product

Resources

About