Malware detection in mobile environments based on Autoencoders and API-images

D’Angelo, Gianni; Ficco, Massimo; Palmieri, Francesco

doi:10.1016/j.jpdc.2019.11.001

Cited by 91 publications

(39 citation statements)

References 44 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…To overcome the shortcomings of traditional detection models, we also need to explore some state-of-the-art modes, i.e., Amin et al [30], Amin et al [31], and D'Angelo et al [32]. We will explore deep learning-based methods to improve the detection rate of malware.…”

Section: Discussionmentioning

confidence: 99%

“…D'Angelo et al [32] transformed API call sequences which are invoked by apps during their execution to APIimages.…”

Section: Related Workmentioning

confidence: 99%

“…e value [27] API call sequence Simple, vulnerable to reorder or irrelevant API calls Lee et al [28] API call sequence Hansen et al [29] API call sequence; arguments; frequency Amin [30,31] Opcode End-to-end learning D'Angelo et al [32] API call sequence-based image Park et al [34] Behavioral graph High dimensional features can bring more calculations Elhadi et al [11] API call graph Nikolopoulos and Polenakis [35] System call dependency graph Fredrikson et al [37] Optimally discriminative specification Simplified representation of behavior graphs Alam et al [40] Control flow graph-based feature Ding et al [41] API dependency graph 4 Mathematical Problems in Engineering 0x0000044c of Handle is used to connect the RegQuer-yValue on line 2. e details of API call graph construction are described in our previous work [43]. It is necessary to extract crucial behaviors from the API call graph for malware classification.…”

Section: Malware Classification Systemmentioning

confidence: 99%

See 2 more Smart Citations

A Novel Malware Classification Method Based on Crucial Behavior

Xiao

Sun

et al. 2020

Mathematical Problems in Engineering

View full text Add to dashboard Cite

Recently, some graph-based methods have been proposed for malware detection. However, current malware is generally characterized by sophisticated behaviors, which makes graph-based malware detection extremely challenging. To address this issue, we propose a graph repartition algorithm by transforming API call graphs into fragment behaviors based on programs’ dynamic execution traces. The proposed algorithm relies on the N-order subgraph (NSG) for constructing the appropriate fragment behavior. Moreover, we improve the term frequency-inverse document frequency- (TF-IDF-) like measure and information gain (IG) to extract the crucial N-order subgraph (CNSG). This novel behavioral representation and improved extraction method can accurately represent crucial behaviors of malware. Experiments on 4,400 samples demonstrate that the proposed method achieves a high accuracy of 99.75% in malware detection and promising performance of 95.27% in malware classification.

show abstract

Section: Discussionmentioning

confidence: 99%

“…D'Angelo et al [32] transformed API call sequences which are invoked by apps during their execution to APIimages.…”

Section: Related Workmentioning

confidence: 99%

Section: Malware Classification Systemmentioning

confidence: 99%

See 1 more Smart Citation

A Novel Malware Classification Method Based on Crucial Behavior

Xiao

Sun

et al. 2020

Mathematical Problems in Engineering

View full text Add to dashboard Cite

show abstract

“…Pektaş and Acarman [36] used deep learning to recognize malware based on the application programming interface (API) call graphs transformed into a numeric feature set as a representation of the malware's execution paths. D'Angelo et al [37] encoded the sequences of API calls invoked by apps as sparse image-like matrices (API images). Then, they used autoencoders to get the most informative features from these images, which were provided to an ANN-based classifier for malware detection.…”

Section: Related Workmentioning

confidence: 99%

Hybrid Malware Classification Method Using Segmentation-Based Fractal Texture Analysis and Deep Convolution Neural Network Features

et al. 2020

View full text Add to dashboard Cite

As the number of internet users increases so does the number of malicious attacks using malware. The detection of malicious code is becoming critical, and the existing approaches need to be improved. Here, we propose a feature fusion method to combine the features extracted from pre-trained AlexNet and Inception-v3 deep neural networks with features attained using segmentation-based fractal texture analysis (SFTA) of images representing the malware code. In this work, we use distinctive pre-trained models (AlexNet and Inception-V3) for feature extraction. The purpose of deep convolutional neural network (CNN) feature extraction from two models is to improve the malware classifier accuracy, because both models have characteristics and qualities to extract different features. This technique produces a fusion of features to build a multimodal representation of malicious code that can be used to classify the grayscale images, separating the malware into 25 malware classes. The features that are extracted from malware images are then classified using different variants of support vector machine (SVM), k-nearest neighbor (KNN), decision tree (DT), and other classifiers. To improve the classification results, we also adopted data augmentation based on affine image transforms. The presented method is evaluated on a Malimg malware image dataset, achieving an accuracy of 99.3%, which makes it the best among the competing approaches.

show abstract

“…Most classical ECG classification methods are based on single-lead methods, which are often accompanied by tedious operations such as filtering, waveform feature extraction, and R point positioning before classifier construction [4][5][6]. Machine learning methods have shown great potential in solving tasks in numerous academic and industrial fields [7,8]. The achievements of artificial intelligence in image recognition, spacecraft modeling, and natural language processing are inspiring.…”

Section: Introductionmentioning

confidence: 99%

Automatic Classification System of Arrhythmias Using 12-Lead ECGs with a Deep Neural Network Based on an Attention Mechanism

Zhao

et al. 2020

Symmetry

View full text Add to dashboard Cite

Nowadays, a series of social problems caused by cardiovascular diseases are becoming increasingly serious. Accurate and efficient classification of arrhythmias according to an electrocardiogram is of positive significance for improving the health status of people all over the world. In this paper, a new neural network structure based on the most common 12-lead electrocardiograms was proposed to realize the classification of nine arrhythmias, which consists of Inception and GRU (Gated Recurrent Units) primarily. Moreover, a new attention mechanism is added to the model, which makes sense for data symmetry. The average F1 score obtained from three different test sets was over 0.886 and the highest was 0.919. The accuracy, sensitivity, and specificity obtained from the PhysioNet public database were 0.928, 0.901, and 0.984, respectively. As a whole, this deep neural network performed well in the multi-label classification of 12-lead ECG signals and showed better stability than other methods in the case of more test samples.

show abstract

Malware detection in mobile environments based on Autoencoders and API-images

Cited by 91 publications

References 44 publications

A Novel Malware Classification Method Based on Crucial Behavior

A Novel Malware Classification Method Based on Crucial Behavior

Hybrid Malware Classification Method Using Segmentation-Based Fractal Texture Analysis and Deep Convolution Neural Network Features

Automatic Classification System of Arrhythmias Using 12-Lead ECGs with a Deep Neural Network Based on an Attention Mechanism

Contact Info

Product

Resources

About