Effective classification of android malware families through dynamic features and neural networks

D’Angelo, Gianni; Palmieri, Francesco; Robustelli, Antonio; Castiglione, Arcangelo

doi:10.1080/09540091.2021.1889977

Cited by 35 publications

(10 citation statements)

References 35 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…It provided an acceptable remedy for the virus recognition dispute. Unpacking and run‐time characteristics, such as network flows, hash fingerprints, permissions, metadata, and API calls, were used by D'Angelo et al (2021) to characterize the idiosyncrasies of the software's behaviour. In order to investigate how to employ deep learning in malware detection, Rathore et al (2022) suggested an image‐based malware detection system.…”

Section: Related Literaturementioning

confidence: 99%

A precise method of identifying Android application family

Li,

Lu,

Wang

et al. 2023

Expert Systems

View full text Add to dashboard Cite

Implementing the necessary countermeasures to detect the growing and highly destructive family of malware is an urgent obligation. The proliferation and diversity of malware make these problems more challenging. For beginners, it is arduous to attain crucial features for multi‐class family classification and extract valuable information from the obtained features. Another issue is that building a classification model that effectively absorbs multi‐class samples and adapts to various features is challenging. This work indicates a precise identification method for Android application families (ANDF) to tackle these issues. It perceptively analyzes the features that multi‐class families can utilize to identify members and further excavates the relationship between implicit information and the severity of those distinctions. A more appropriate classification model is developed for the heterogeneous file formats, and a more beneficial feature with a diverse array of heterogeneous information is chosen as the replacement representation of the sample. It is capable of upgrading learning ability and mastering the multi‐modal traits of the family malware. The application of ANDF to real data sets yields effective classification results. It is capable of 0.9800 in f1‐macro and has a classification accuracy of 98.61%. It performs, respectively, 0.0088 points better than the two‐feature comparison classification model and 0.0872 points better than the single‐feature comparison classification model. The kappa coefficient can also exceed 0.9830, which is at least 0.1044 higher than other contrasting classifiers and is 0.0105 greater than that of the contrasted model containing two features, which is 0.1046 larger than the classifier with a contrasting single feature.

show abstract

Section: Related Literaturementioning

confidence: 99%

A precise method of identifying Android application family

Li,

Lu,

Wang

et al. 2023

Expert Systems

View full text Add to dashboard Cite

show abstract

“…Finally, in 2021, D'Angelo et al [12] proposed a CNN and a recurrent neural network (RNN), based on API-images, in order to classify different malware families. More precisely, they used both neural networks on five malware families on the Unisa malware dataset (UMD) by achieving 99% in average accuracy.…”

Section: Related Workmentioning

confidence: 99%

A federated approach to Android malware classification through Perm-Maps

2022

Self Cite

View full text Add to dashboard Cite

In the last decades, mobile-based apps have been increasingly used in several application fields for many purposes involving a high number of human activities. Unfortunately, in addition to this, the number of cyber-attacks related to mobile platforms is increasing day-by-day. However, although advances in Artificial Intelligence science have allowed addressing many aspects of the problem, malware classification tasks are still challenging. For this reason, the following paper aims to propose new special features, called permission maps (Perm-Maps), which combine information related to the Android permissions and their corresponding severity levels. Such features have proven to be very effective in classifying different malware families through the usage of a convolutional neural network. Also, the advantages introduced by the Perm-Maps have been enhanced by a training process based on a federated logic. Experimental results show that the proposed approach achieves up to a 3% improvement in average accuracy with respect to J48 trees and Naive Bayes classifier, and up to 16% compared to multi-layer perceptron classifier. Furthermore, the combined use of Perm-Maps and federated logic allows dealing with unbalanced training datasets with low computational efforts.

show abstract

“…The increased occurrences of cyberattacks are a direct result of phenomenal growth and the development of IoT gadgets in these fields in terms of smart manufacturing, smart grids, patient monitoring systems, logistics and environmental monitoring. It is challenging to accomplish the security management of IoT networks due to the transient and dynamic nature of the links among the devices, the diversity of the players who can interact with IoT networks and resource limitations [3]. The global IoT security market is anticipated to expand at an Annual Growth Rate of 33.7%, owing to multiple factors such as a high number of cyberattacks on IoT gadgets, heavy regulations on IoT security and an increased number of security concerns [4].…”

Section: Introductionmentioning

confidence: 99%

Graph Convolutional Neural Network Based Malware Detection in IoT-Cloud Environment

Alsubaei¹,

Alshahrani²,

Tarmissi³

et al. 2023

Intelligent Automation &Amp; Soft Computing

View full text Add to dashboard Cite

Cybersecurity has become the most significant research area in the domain of the Internet of Things (IoT) owing to the ever-increasing number of cyberattacks. The rapid penetration of Android platforms in mobile devices has made the detection of malware attacks a challenging process. Furthermore, Android malware is increasing on a daily basis. So, precise malware detection analytical techniques need a large number of hardware resources that are significantly resource-limited for mobile devices. In this research article, an optimal Graph Convolutional Neural Network-based Malware Detection and classification (OGCNN-MDC) model is introduced for an IoT-cloud environment. The proposed OGCNN-MDC model aims to recognize and categorize malware occurrences in IoT-enabled cloud platforms. The presented OGCNN-MDC model has three stages in total, such as data pre-processing, malware detection and parameter tuning. To detect and classify the malware, the GCNN model is exploited in this work. In order to enhance the overall efficiency of the GCNN model, the Group Mean-based Optimizer (GMBO) algorithm is utilized to appropriately adjust the GCNN parameters, and this phenomenon shows the novelty of the current study. A widespread experimental analysis was conducted to establish the superiority of the proposed OGCNN-MDC model. A comprehensive comparison study was conducted, and the outcomes highlighted the supreme performance of the proposed OGCNN-MDC model over other recent approaches.

show abstract

Effective classification of android malware families through dynamic features and neural networks

Cited by 35 publications

References 35 publications

A precise method of identifying Android application family

A precise method of identifying Android application family

A federated approach to Android malware classification through Perm-Maps

Graph Convolutional Neural Network Based Malware Detection in IoT-Cloud Environment

Contact Info

Product

Resources

About