Paper Info
Title
Static malware detection and attribution in android byte-code through an end-to-end deep system
Abstract
Android reflects a revolution in handhelds and mobile devices. It is a virtual machine based, an open source mobile platform that powers millions of smartphone and devices and even a larger no. of applications in its ecosystem. Surprisingly in a short lifespan, Android has also seen a colossal expansion in application malware with 99% of the total malware for smartphones being found in the Android ecosystem. Subsequently, quite a few techniques have been proposed in the literature for the analysis and detection of these malicious applications for the Android platform. The increasing and diversified nature of Android malware has immensely attenuated the usefulness of prevailing malware detectors, which leaves Android users susceptible to novel malware. Here in this paper, as a remedy to this problem, we propose an anti-malware system that uses customized learning models, which are sufficiently deep, and are ’End to End deep learning architectures which detect and attribute the Android malware via opcodes extracted from application bytecode’. Our results show that Bidirectional long short-term memory (BiLSTMs) neural networks can be used to detect static behavior of Android malware beating the state-of-the-art models without using handcrafted features. For our experiments in our system, we also choose to work with distinct and independent deep learning models leveraging sequence specialists like recurrent neural networks, Long Short Term Memory networks and its Bidirectional variation as well as those are more usual neural architectures like a network of all connected layers(fully connected), deep convnets, Diabolo network (autoencoders) and generative graphical models like deep belief networks for static malware analysis on Android. To test our system, we have also augmented a bytecode dataset from three open and independently maintained state-of-the-art datasets. Our bytecode dataset, which is on an order of magnitude large, essentially suffice for our experiments. Our results suggests that our proposed system can lead to better design of malware detectors as we report an accuracy of 0.999 and an F1-score of 0.996 on a large dataset of more than 1.8 million Android applications.
Year
DOI
Venue
2020
10.1016/j.future.2019.07.070
Future Generation Computer Systems
Keywords
Field
DocType
End-to-end architecture,Malware analysis,Deep neural networks,Android and big data
Opcode,Android (operating system),Virtual machine,Computer science,Deep belief network,Real-time computing,Artificial intelligence,Deep learning,Malware,Bytecode,Operating system,Malware analysis
Journal
Volume
ISSN
Citations 
102
0167-739X
1
PageRank 
References 
Authors
0.35
0
6
Name
Order
Citations
PageRank
Muhammad Amin121.04
Tamleek Ali Tanveer210.35
Mohammad Tehseen310.35
Murad Khan415022.14
Fakhri Alam Khan5245.51
Sajid Anwar618419.96