Hybrid sequence‐based Android malware detection using natural language processing

Abstract

Android platform has been the target of attackers due to its openness and increasing popularity. Android malware has explosively increased in recent years, which poses serious threats to Android security. Thus proposing efficient Android malware detection methods is curial in defeating malware. Various features extracted from static or dynamic analysis using machine learning have played an important role in malware detection recently. However, existing code obfuscation, code encryption, and dynamic code loading techniques can be employed to hinder systems that single based on static analysis, purely dynamic analysis systems cannot detect all potential code execution paths. To address these issues, we propose CoDroid, a sequence-based hybrid Android malware detection method, which utilizes the sequences of static opcode and dynamic system call. We treat one sequence as a sentence in the natural language processing and construct a CNN-BiLSTM-Attention classifier which consists of Convolutional Neural Networks (CNNs), the Bidirectional Long Short-Term Memory (BiLSTM) with an attention language model. We extensively evaluate CoDroid under a real-world data set and perform comprehensive analysis against other existing related detection methods. The evaluations show the effectiveness and flexibility of CoDroid across a variety of experimental settings.

DRVAT: Exploring RSSI series representation and attention model for indoor positioning

“…In NLP, we have words, sentences (or semantic context of words), and the task of understanding the meaning of sentences; in IPS, we have Beacon expressions, collection of expressions (or positioning semantic context ), and the task of inferring a location. This new perspective thus inspires us to introduce the latest NLP technologies and adapt them to solve the IPS problem 22 . Indeed, the task of BLE localization is similar to that of text understanding in NLP to some extent—they all make inferences based on a finite sequence—words in a sentence or Beacon expressions collected at a location.…”

“…This new perspective thus inspires us to introduce the latest NLP technologies and adapt them to solve the IPS problem. 22 Indeed, the task of BLE localization is similar to that of text understanding in NLP to some extent-they all make inferences based on a finite sequence-words in a sentence or Beacon expressions collected at a location.…”

“…We compare the performance of DRVAT to SAE in the two cases of unplugging 6 Beacons (No. 11~13, 15,19,22) and 12 Beacons (No. 9~15, 19, 22~25).…”

Label distribution‐based noise correction for multiclass crowdsourcing

“…4 It provides an economical and efficient way to obtain large amounts of labeled data quickly. This way is very suitable for labeling large amounts of image and voice data and has been widely used in natural language processing, 5 speech recognition, 6 image classification, 7 and other fields.…”

A robust packet‐dropping covert channel for mobile intelligent terminals

“…In recent years, some research efforts have focused on constructing covert timing channels (CTCs) over wireless and VoLTE networks. [7][8][9] Some of these solutions [10][11][12] are quite feasible, as they build CTCs by adjusting the timing behavior of legitimate channels, such as controlling resource consumption rates or managing packet delivery schedules in predefined time windows. [13][14][15][16] Covert timing channels have been explored in multiple ways especially over traditional Ethernet, and different efficient solutions have been proposed.…”