RAPSAMS: Robust affinity propagation clustering on static android malware stream

Abstract

This article proposed RAPSAMS, extending affinity propagation (AP) clustering to be robust in malware steaming. We use AP, which has been suggested as an approach for clustering a set of samples that by passing messages in different clusters, represents malware stream clustering. Then, by generating and adding adversarial examples, a method has been proposed to attack this clustering algorithm and try to make a robust algorithm against the proposed attack. Malware clustering has become an active research area in mobile security, in which the knowledge is being exploited in large quantities of the generated malware stream. Different procedures have been used that apply clustering to the malware's static features. This article focuses on selecting the most appropriate examples as centers for Android malware clusters and tries to add some perturbation to fool the clustering algorithm. There are two important challenges in this regard: (i) How to find the best representations for clustering.(ii) How to manage extracted patterns that include important data flow characteristics with different distributions. Malware stream clustering poses many challenges to solve this problem, including dealing with malware that is imported online, being able to process malware quickly and incrementally, dealing appropriately with time constraints, and the way that can manage important features patterns of malware stream.To examine the adaptability of the proposed methods of defense and attack, analyses were performed. The proposed approaches are tested on a couple of malware Android dataset benchmarks, namely, Contagio, Genome, and Drebin. We use permission, API, and intent features of these datasets. The obtained results from false positive rate (FPR) recognize that the amounts of the known algorithm for clustering, AP, increases to more than 50% afterward an offense occurs in a number of instances (like: Genome dataset in permission and intent features). Furthermore, by applying the label flipping attack (LFA) the accuracy measures decrease lower than 85% in all instances. Also, the proposed defense method decreased the FPR value by less than 30%, and the accuracy increased by more than 91%, in all cases. Consequently, the AP clustering will be robust against LFAs.

Automatic Aggregation Enhanced Affinity Propagation Clustering Based on Mutually Exclusive Exemplar Processing

“…AP offers several advantages, including simple initialization, the absence of a requirement to specify the cluster number, superior clustering quality, and high computational efficiency. AP has been widely employed in manifold aspects such as face recognition [24,25], document clustering [26,27], neural network classifier [28], image analysis [29,30], grid system data clustering [31,32], small cell networks working analysis [33], manufacturing process analysis [34], bearing fault diagnosis [35][36][37], K-Nearest Neighbor (KNN) positioning [38], psychological research [39], radio environment map analysis [40], building evaluation [41], building materials analysis [42], interference management [43], genome sequences analysis [44], map generalization [45], signal recognizing [46], vehicle counting [47], indoor positioning [48], android malware analysis [49], marine water quality monitoring [50], and groundwater management [51].…”

Proactive ransomware prevention in pervasive IoMT via hybrid machine learning

“…The key step in Bayesian optimization is the construction of the probabilistic model of 𝑓(𝑥), which is typically done using Bayesian regression technique (i.e., Bayesian ridge regression).  Deployed the trained models to detect ransomware in real-time using streaming data processing [38].…”