.png){kind=icon}
返回
A novel Android malware detection method with API semantics extraction
.png){kind=icon}
PRE
AI
DOI：10.1016/j.cose.2023.103651.png)
.png){kind=icon}
原文求助.png){kind=icon}
分享.png){kind=icon}
收藏
摘要
En 中文
Due to the continuous evolution of both the Android framework and malware, conventional malware detection methods that have been trained using outdated apps are inadequate in effectively identifying sophisticated evolved malware. To address this issue, in this paper, we propose a novel Android malware detection method with API semantics extraction (AMDASE), it can effectively identify evolved malware instances. Firstly, AMDASE performs API clustering to obtain cluster centers representing API functions before malware detection. We design API sentence to summarize API features and employ natural language processing (NLP) tools to acquire embeddings of API sentence for clustering. With the help of API sentence, it becomes possible to effectively extract the semantics of API contained in features like method name that accurately represents its intended functionality, which also makes the clustering results more accurate. Secondly, AMDASE extracts call graph from each app and optimizes the call graph by removing nodes corresponding to unknown functions, while ensuring the preservation of connectivity between their predecessor and successor nodes. The optimized call graph can extract more robust API contextual information that accurately represents the behavior of each app. Thirdly, in order to maintain resilience against the evolution of Android malware, AMDASE extracts function call pairs from the optimized call graph and abstracts the APIs in function call pairs into cluster centers obtained in API clustering. Finally, feature vectors are generated using one-hot mapping and machine learning classifiers are used for malware detection. We evaluate AMDASE on a dataset of 42,154 benign and 42,450 malicious apps developed over a seven-year period. The experimental results demonstrate that AMDASE greatly outperforms the existing state-of-the-art methods and has a significantly slower aging speed.
Keyword:
Evolved malware detection
Model aging
API semantics
Function call graph
Machine learning
期刊
C
IF:
5.4
论文数:
4.6K
被引数:
1.4W
机构
引用论文
Using multi-audio feature fusion for android malware detection使用多音频特征融合进行android恶意软件检测.png)
COMPUTERS & SECURITY
COMPUTERS & SECURITYIF5.4
PREAI
分享收藏DroidRL: Feature selection for android malware detection with reinforcement learningDroidRL: 通过强化学习进行android恶意软件检测的功能选择COMPUTERS & SECURITY
OAAI
COMPUTERS & SECURITYIF5.4
OAAI分享收藏Economic benefit evaluation method for the micro-grid renewable energy system operation微网可再生能源系统运行经济效益评价方法
PREAI
分享收藏A dynamic programming approach to missing data estimation using neural networks使用神经网络进行缺失数据估计的动态规划方法
PREAI
分享收藏
查看更多内容