DroidDelver: An Android Malware Detection System Using Deep Belief Network Based on API Call Blocks

Hou, Shifu; Saas, Aaron; Ye, Yanfang; Chen, Lifei

doi:10.1007/978-3-319-47121-1_5

Cited by 74 publications

(42 citation statements)

References 17 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…They used autoencoders coupled with a sigmoid classification layer for this task and achieved a 95.64% accuracy. Benchea and Gavriluţ [84], Xu et al [85], Hou et al [86], Zhu et al [87], and Ye et al [88] used RBMs. Success with these varied depending on the datasets and methods.…”

Section: Detectionmentioning

confidence: 99%

“…Success with these varied depending on the datasets and methods. Hardy et al [83], Hou et al [86], and Ye et al [88] all used the Comodo Cloud Security Center dataset 66 and 96.6% accuracy [86] or a 97.9% TPR [88]. Benchea and Gavriluţ [84] used a custom dataset and achieved 99.72% accuracy with a 90.1% true positive rate.…”

Section: Detectionmentioning

confidence: 99%

“…Xu et al [85] achieved a 93.4% accuracy on a Google Play Store [63] and VirusShare [68] dataset achieved. Zhu et al [86] used a dataset combining Google Play Store [63], Genome [67], DREBIN [69], and VirusTotal [64] data, and achieved an F1 Score of 95.05%. Alternatively, the raw software binaries can be used as features.…”

Section: Detectionmentioning

confidence: 99%

See 2 more Smart Citations

A Survey of Deep Learning Methods for Cyber Security

et al. 2019

View full text Add to dashboard Cite

This survey paper describes a literature review of deep learning (DL) methods for cyber security applications. A short tutorial-style description of each DL method is provided, including deep autoencoders, restricted Boltzmann machines, recurrent neural networks, generative adversarial networks, and several others. Then we discuss how each of the DL methods is used for security applications. We cover a broad array of attack types including malware, spam, insider threats, network intrusions, false data injection, and malicious domain names used by botnets.

show abstract

Section: Detectionmentioning

confidence: 99%

Section: Detectionmentioning

confidence: 99%

See 1 more Smart Citation

A Survey of Deep Learning Methods for Cyber Security

et al. 2019

View full text Add to dashboard Cite

show abstract

“…Droiddeep [39] built the model by DBN as well, but used some more features (e.g., actions and components). DroidDelver [40] and DroidDeepLearner [41] are another two models built on DBN, where permissions and API calls were taken as features. Mclaughlin [14] designed the detection systems by Convolutional Neural Network (CNN), using opcode sequences as features.…”

Section: Related Workmentioning

confidence: 99%

CDGDroid: Android Malware Detection Based on Deep Learning Using CFG and DFG

Ren

Qin

et al. 2018

Formal Methods and Software Engineering

View full text Add to dashboard Cite

Android malware has become a serious threat in our daily digital life, and thus there is a pressing need to effectively detect or defend against them. Recent techniques have relied on the extraction of lightweight syntactic features that are suitable for machine learning classification, but despite of their promising results, the features they extract are often too simple to characterise Android applications, and thus may be insufficient when used to detect Android malware. In this paper, we propose CDGDroid, an effective approach for Android malware detection based on deep learning. We use the semantics graph representations, that is, control flow graph, data flow graph, and their possible combinations, as the features to characterise Android applications. We encode the graphs into matrices, and use them to train the classification model via Convolutional Neural Network (CNN). We have conducted some experiments on Marvin, Drebin, VirusShare and ContagioDump datasets to evaluate our approach and have identified that the classification model taking the horizontal combination of CFG and DFG as features offers the best performance in terms of accuracy among all combinations. We have also conducted experiments to compare our approach against Yeganeh Safaei et al.'s approach, Allix et al.'s approach, Drebin and many antivirus tools gathered in VirusTotal, and the experimental results have confirmed that our classification model gives a better performance than the others.

show abstract

“…As a result, many research efforts have been conducted on applying machine learning techniques for intelligent malware detection [140,7,90,139,142,95,60,39,67,68,151,131,132,137,69]. In these systems, based on different feature representations (e.g., binary n-grams [7], system call graphs [101,67], dynamic behaviors [49,132], or Application Programming Interface (API) call blocks [68]), various kinds of classification approaches, such as support vector machine [153,79,44,114], random forest [1] and deep neural network [68,67,60], are used for model construction to detect malicious files, which have offered unparalleled flexibility in intelligent malware detection. Most of the existing systems using machine learning techniques merely utilize local features either statically or dynamically extracted from the file samples to detect malware.…”

Section: Acknowledgmentsmentioning

confidence: 99%

Intelligent Malware Detection Using File-to-file Relations and Enhancing its Security against Adversarial Attacks

Chen¹

View full text Add to dashboard Cite

Intelligent Malware Detection Using File-to-file Relations and Enhancing its Security against Adversarial Attacks Lingwei Chen With computing devices and the Internet being indispensable in people's everyday life, malware has posed serious threats to their security, making its detection of utmost concern. To protect legitimate users from the evolving malware attacks, machine learning-based systems have been successfully deployed and offer unparalleled flexibility in automatic malware detection. In most of these systems, resting on the analysis of different content-based features either statically or dynamically extracted from the file samples, various kinds of classifiers are constructed to detect malware. However, besides content-based features, file-to-file relations, such as file coexistence , can provide valuable information in malware detection and make evasion harder. To better understand the properties of file-to-file relations, we construct the file coexistence graph. Resting on the constructed graph, we investigate the semantic relatedness among files, and leverage graph inference, active learning and graph representation learning for malware detection. Comprehensive experimental results on the real sample collections from Comodo Cloud Security Center demonstrate the effectiveness of our proposed learning paradigms. As machine learning-based detection systems become more widely deployed, the incentive for defeating them increases. Therefore, we go further insight into the arms race between adversarial malware attack and defense, and aim to enhance the security of machine learning-based malware detection systems. In particular, we first explore the adversarial attacks under different scenarios (i.e., different levels of knowledge the attackers might have about the targeted learning system), and define a general attack strategy to thoroughly assess the adversarial behaviors. Then, considering different skills and capabilities of the attackers, we propose the corresponding secure-learning paradigms to counter the adversarial attacks and enhance the security of the learning systems while not compromising the detection accuracy. We conduct a series of comprehensive experimental studies based on the real sample collections from Comodo Cloud Security Center and the promising results demonstrate the effectiveness of our proposed securelearning models, which can be readily applied to other detection tasks. Contents Acknowledgments iii List of Figures vi List of Tables ix List of Notations x List of Acronyms xii List of Figures vii 4.2 Different scenarios of the adversarial attacks. With the direction of the inward arrow, the adversarial attacks are depicted with the knowledge of (X,D), (X, D), and (X, D, f

show abstract

DroidDelver: An Android Malware Detection System Using Deep Belief Network Based on API Call Blocks

Cited by 74 publications

References 17 publications

A Survey of Deep Learning Methods for Cyber Security

A Survey of Deep Learning Methods for Cyber Security

CDGDroid: Android Malware Detection Based on Deep Learning Using CFG and DFG

Intelligent Malware Detection Using File-to-file Relations and Enhancing its Security against Adversarial Attacks

Contact Info

Product

Resources

About