PICAndro: Packet InspeCtion-Based Android Malware Detection

Abstract

The post-COVID epidemic world has increased dependence on online businesses for day-to-day life transactions over the Internet, especially using the smartphone or handheld devices. This increased dependence has led to new attack surfaces which need to be evaluated by security researchers. The large market share of Android attracts malware authors to launch more sophisticated malware (12000 per day). The need to detect them is becoming crucial. Therefore, in this paper, we propose PICAndro that can enhance the accuracy and the depth of malware detection and categorization using packet inspection of captured network traffic. The identified network interactions are represented as images, which are fed in the CNN engine. It shows improved performance with the accuracy of 99.12% and 98.91% for malware detection and malware class detection, respectively, with high precision.

Android-SEM: Generative Adversarial Network for Android Malware Semantic Enhancement Model Based on Transfer Learning

“…We validated the model against the dataset described in the previous section. We also compared our proposed method with existing methods, specifically those proposed by Haq et al [44] and Sihag et al [45]. Their datasets were significantly similar to ours and are publicly available.…”

“…For comparison, Sihag et al [45] used a CNN engine to determine the maliciousness and type of malware by capturing network data packets to generate images, and they achieved accuracy levels of 99.12% and 98.91%, respectively. By contrast, Haq et al [44] used a method for generating images based on entire APK files and applied a CNN model based on transfer learning for training, obtaining an accuracy level of 96.4%.…”

Android malware analysis in a nutshell

“…[ 37 ] mapped permissions to severity levels [ 38 ]to create images to be fed to the CNN model for malware classification. Other methods such as [ 39 ] used network interactions as features to be converted to images to be input for CNN.…”

“…The main ones were Drebin and AMD. Some of them used DREBIN alone, such as [ 31 , 36 ], and some of them used only AMD, such as [ 39 ]. However, most of them used a combination of both [ 32 , 33 , 35 , 37 ].…”

“…This can be clearly observed in the comparison conducted among the related work and our proposed analysis model, as shown in Table 1 . For example, in terms of the employed CNN algorithms used, most of the related works examined a few models such as VGG16, ResNet, and customized CNN algorithms such as in [ 30 – 32 , 34 – 37 , 39 ]. Moreover, they did not take into consideration all different file formats of Android malware samples.…”