Discovering optimal features using static analysis and a genetic search based method for Android malware detection

Mobile device manufacturers are rapidly producing miscellaneous Android versions worldwide. Simultaneously, cyber criminals are executing malicious actions, such as tracking user activities, stealing personal data, and committing bank fraud. These criminals gain numerous benefits as too many people use Android for their daily routines, including important communi-cations. With this in mind, security practitioners have conducted static and dynamic analyses to identify malware. This study used static analysis because of its overall code coverage, low resource consumption, and rapid processing. However, static analysis requires a minimum number of features to efficiently classify malware. Therefore, we used genetic search (GS), which is a search based on a genetic algorithm (GA), to select the features among 106 strings. To evaluate the best features determined by GS, we used five machine learning classifiers, namely, Naïve Bayes (NB), functional trees (FT), J48, random forest (RF), and multilayer perceptron (MLP). Among these classifiers, FT gave the highest accuracy (95%) and true positive rate (TPR) (96.7%) with the use of only six features.     

Artificial neural networks and genetic algorithm for bearing fault detection

A study is presented to compare the performance of three types of artificial neural network (ANN), namely, multi layer perceptron (MLP), radial basis function (RBF) network and probabilistic neural network (PNN), for bearing fault detection. Features are extracted from time domain vibration signals, without and with preprocessing, of a rotating machine with normal and defective bearings. The extracted features are used as inputs to all three ANN classifiers: MLP, RBF and PNN for two- class (normal or fault) recognition. Genetic algorithms (GAs) have been used to select the characteristic parameters of the classifiers and the input features. For each trial, the ANNs are trained with a subset of the experimental data for known machine conditions. The ANNs are tested using the remaining set of data. The procedure is illustrated using the experimental vibration data of a rotating machine. The roles of different vibration signals and preprocessing techniques are investigated. The results show the effectiveness of the features and the classifiers in detection of machine condition.     

Android malware detection through hybrid features fusion and ensemble classifiers: The AndroPyTool framework and the OmniDroid dataset

Cybersecurity has become a major concern for society, mainly motivated by the increasing number of cyber attacks and the wide range of targeted objectives. Due to the popularity of smartphones and tablets, Android devices are considered an entry point in many attack vectors. Malware applications are among the most used tactics and tools to perpetrate a cyber attack, so it is critical to study new ways of detecting them. In these detection mechanisms, machine learning has been used to build classifiers that are effective in discerning if an application is malware or benignware. However, training such classifiers require big amounts of labelled data which, in this context, consist of categorised malware and benignware Android applications represented by a set of features able to describe their behaviour. For that purpose, in this paper we present OmniDroid, a large and comprehensive dataset of features extracted from 22,000 real malware and goodware samples, aiming to help anti-malware tools creators and researchers when improving, or developing, new mechanisms and tools for Android malware detection. Furthermore, the characteristics of the dataset make it suitable to be used as a benchmark dataset to test classification and clustering algorithms or new representation techniques, among others. The dataset has been released under a Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International License and was built using AndroPyTool, our automated framework for dynamic and static analysis of Android applications. Finally, we test a set of ensemble classifiers over this dataset and propose a malware detection approach based on the fusion of static and dynamic features through the combination of ensemble classifiers. The experimental results show the feasibility and potential usability (for the machine learning, soft computing and cyber security communities) of our automated framework and the publicly available dataset.     

基于深度信念网络的Android恶意应用检测方法

传统的机器学习算法无法有效地从海量的行为特征中选择出有本质的行为特征来对未知的Android恶意应用进行检测。为了解决这个问题,提出DBNSel,一种基于深度信念网络模型的Android恶意应用检测方法。为了实现该方法,首先通过静态分析方法从Android应用中提取5类不同的属性。其次,建立深度信念网络模型从提取到的属性中进行选择和学习。最后,使用学习到的属性来对未知类型的Android恶意应用进行检测。在实验阶段,使用一个由3 986个Android正常应用和3 986个Android恶意应用组成的数据集来验证DBNSel的有效性。实验结果表明,DBNSel的检测结果要优于其他几种已有的检测方法,并可以达到99.4%的检测准确率。此外,DBNSel具有较低的运行开销,可以适应于更大规模的真实环境下的Android恶意应用检测。     

基于深度神经网络的Android恶意软件检测方法

Android 系统正日益面临着恶意软件的攻击威胁。针对支持向量机等传统机器学习方法难以有效进行大样本多分类的恶意软件检测,提出一种基于深度神经网络的Android恶意软件检测与家族分类方法。该方法在全面提取应用组件、Intent Filter、权限、数据流等特征基础上,进行有效的特征选择以降低维度,基于深度神经网络进行面向恶意软件的大样本多分类检测。实验结果表明,该方法能够进行有效检测和分类,良性、恶意二分类精度为 97.73%,家族多分类精度可达到 93.54%,比其他机器学习算法有更好的分类效果。     

基于深度学习的安卓恶意应用检测

针对传统安卓恶意程序检测技术检测准确率低,对采用了重打包和代码混淆等技术的安卓恶意程序无法成功识别等问题,设计并实现了DeepDroid算法。首先,提取安卓应用程序的静态特征和动态特征,结合静态特征和动态特征生成应用程序的特征向量;然后,使用深度学习算法中的深度置信网络（DBN）对收集到的训练集进行训练,生成深度学习网络;最后,利用生成的深度学习网络对待测安卓应用程序进行检测。实验结果表明,在使用相同测试集的情况下,DeepDroid算法的正确率比支持向量机（SVM）算法高出3.96个百分点,比朴素贝叶斯（Naive Bayes）算法高出12.16个百分点,比K最邻近（KNN）算法高出13.62个百分点。DeepDroid算法结合了安卓应用程序的静态特征和动态特征,采用了动态检测和静态检测相结合的检测方法,弥补了静态检测代码覆盖率不足和动态检测误报率高的缺点,在特征识别的部分采用DBN算法使得网络训练速度得到保证的同时还有很高的检测正确率。     

Investigation of Android Malware with Machine Learning Classifiers using Enhanced PCA Algorithm

Android devices are popularly available in the commercial market at different price levels for various levels of customers. The Android stack is more vulnerable compared to other platforms because of its open-source nature. There are many android malware detection techniques available to exploit the source code and find associated components during execution time. To obtain a better result we create a hybrid technique merging static and dynamic processes. In this paper, in the first part, we have proposed a technique to check for correlation between features and classify using a supervised learning approach to avoid Multicollinearity problem is one of the drawbacks in the existing system. In the proposed work, a novel PCA (Principal Component Analysis) based feature reduction technique is implemented with conditional dependency features by gathering the functionalities of the application which adds novelty for the given approach. The Android Sensitive Permission is one major key point to be considered while detecting malware. We select vulnerable columns based on features like sensitive permissions, application program interface calls, services requested through the kernel, and the relationship between the variables henceforth build the model using machine learning classifiers and identify whether the given application is malicious or benign. The final goal of this paper is to check benchmarking datasets collected from various repositories like virus share, Github, and the Canadian Institute of cyber security, compare with models ensuring zero-day exploits can be monitored and detected with better accuracy rate.     

基于可解释性的Android恶意软件检测

针对Android恶意软件检测, 通常仅有检测结果缺乏对其检测结果的可解释性. 基于此, 从可解释性的角度分析Android恶意软件检测, 综合利用多层感知机和注意力机制提出一种可解释性的Android恶意软件检测方法(multilayer perceptron attention-method, MLP_At). 通过提取Android恶意软件的应用权限和应用程序接口(application programming interface, API)特征来进行数据预处理生成特征信息, 采用多层感知机对特征学习. 最后, 利用BP算法对学习到的数据进行分类识别. 在多层感知机中引入注意力机制, 以捕获敏感特征, 根据敏感特征生成描述来解释应用的核心恶意行为. 实验结果表明所提方法能有效检测恶意软件, 与SVM、RF、XGBoost相比准确率分别提高了3.65%、3.70%和2.93%, 并能准确地揭示软件的恶意行为. 此外, 该方法还可以解释样本被错误分类的原因.     

基于数据流深度学习算法的Android恶意应用检测方法

目前针对未知的Android恶意应用可以采用机器学习算法进行检测,但传统的机器学习算法具有少于三层的计算单元,无法充分挖掘Android应用程序特征深层次的表达。文中首次提出了一种基于深度学习的算法DDBN （Data-flow Deep BeliefNetwork）对Android应用程序数据流特征进行分析,从而检测Android未知恶意应用。首先,使用分析工具FlowDroid和SUSI提取能够反映Android应用恶意行为的静态数据流特征;然后,针对该特征设计了数据流深度学习算法DDBN,该算法通过构建深层的模型结构,并进行逐层特征变换,将数据流在原空间的特征表示变换到新的特征空间,从而使分类更加准确;最后,基于DDBN实现了Android恶意应用检测工具Flowdect,并对现实中的大量安全应用和恶意应用进行检测。实验结果表明,Flowdect能够充分学习Android应用程序的数据流特征,用于检测未知的Android恶意应用。通过与其他基于传统机器学习算法的检测方案对比,DDBN算法具有更优的检测效果。     

基于灰度图纹理指纹的恶意软件分类

随着安卓恶意软件数量的快速增长,传统的恶意软件检测与分类机制存在检测率低、训练模型复杂度高等问题。为解决上述问题,结合图像纹理特征提取技术和机器学习分类器,提出基于灰度图纹理特征的恶意软件分类方法。该方法首先将恶意软件样本生成灰度图,设计并集成了包含GIST和Tamura特征提取算法在内的4种特征提取方法;然后将所得纹理特征集合作为源数据,基于Caffe高性能处理架构构造了5种分类学习模型,最终实现对恶意软件的检测和分类。实验结果表明,基于图像纹理特征的恶意软件分类具有较高的准确率,且Caffe架构能有效缩短学习时间,降低复杂度。     

安卓恶意软件的静态检测方法

近几年,Android平台的恶意软件数量几乎以几何式的速度增长,故提出一种恶意软件检测方法是必要的.本文利用现如今疯涨的Android恶意样本量和机器学习算法建立分类预测模型实现对恶意软件的静态检测.首先,通过反编译APK文件获取AndroidManifest.xml文件中权限特征,baksmali工具反编译class.dex成smali文件得到危险API特征.然后运用机器学习中多种分类和预处理算法比较每一特征和联合特征检测的准确率.实验结果表明,联合特征检测准确率高于单独特征,准确率达到97.5%.     

A Learning Model to Detect Android C&C Applications Using Hybrid Analysis

Smartphone devices particularly Android devices are in use by billions of people everywhere in the world. Similarly, this increasing rate attracts mobile botnet attacks which is a network of interconnected nodes operated through the command and control (C&C) method to expand malicious activities. At present, mobile botnet attacks launched the Distributed denial of services (DDoS) that causes to steal of sensitive data, remote access, and spam generation, etc. Consequently, various approaches are defined in the literature to detect mobile botnet attacks using static or dynamic analysis. In this paper, a novel hybrid model, the combination of static and dynamic methods that relies on machine learning to detect android botnet applications is proposed. Furthermore, results are evaluated using machine learning classifiers. The Random Forest (RF) classifier outperform as compared to other ML techniques i.e., Naïve Bayes (NB), Support Vector Machine (SVM), and Simple Logistic (SL). Our proposed framework achieved 97.48% accuracy in the detection of botnet applications. Finally, some future research directions are highlighted regarding botnet attacks detection for the entire community.     

HEMD: a highly efficient random forest-based malware detection framework for Android

Mobile phones are rapidly becoming the most widespread and popular form of communication; thus, they are also the most important attack target of malware. The amount of malware in mobile phones is increasing exponentially and poses a serious security threat. Google’s Android is the most popular smart phone platforms in the world and the mechanisms of permission declaration access control cannot identify the malware. In this paper, we proposed an ensemble machine learning system for the detection of malware on Android devices. More specifically, four groups of features including permissions, monitoring system events, sensitive API and permission rate are extracted to characterize each Android application (app). Then an ensemble random forest classifier is learned to detect whether an app is potentially malicious or not. The performance of our proposed method is evaluated on the actual data set using tenfold cross-validation. The experimental results demonstrate that the proposed method can achieve a highly accuracy of 89.91%. For further assessing the performance of our method, we compared it with the state-of-the-art support vector machine classifier. Comparison results demonstrate that the proposed method is extremely promising and could provide a cost-effective alternative for Android malware detection.

     

Android平台恶意应用程序静态检测方法

本文构建的静态检测系统主要用于检测Android平台未知恶意应用程序.首先,对待检测应用程序进行预处理,从Android Manifest.xml文件中提取权限申请信息作为一类特征属性;如待检测应用程序存在动态共享库,则提取从第三方调用的函数名作为另一类特征属性.对选取的两类特征属性分别选择最优分类算法,最后根据上述的两个最优分类算法对待检测应用程序的分类结果判定待检测应用程序是否为恶意应用程序.实验结果表明:该静态检测系统能够有效地检测出Android未知恶意应用程序,准确率达到95.4%,具有良好的应用前景.     

深度可分离卷积在Android恶意软件分类的应用研究

传统机器学习在恶意软件分析上需要复杂的特征工程,不适用于大规模的恶意软件分析。为提高在Android恶意软件上的检测效率,将Android恶意软件字节码文件映射成灰阶图像,综合利用深度可分离卷积（depthwise separable convolution,DSC）和注意力机制提出基于全局注意力模块（GCBAM）的Android恶意软件分类模型。从APK文件中提取字节码文件,将字节码文件转换为对应的灰阶图像,通过构建基于GCBAM的分类模型对图像数据集进行训练,使其具有Android恶意软件分类能力。实验表明,该模型对Android恶意软件家族能有效分类,在获取的7 630个样本上,分类准确率达到98.91%,相比机器学习算法在准确率、召回率等均具有较优效果。     

A new machine learning-based method for android malware detection on imbalanced dataset

Nowadays, malware applications are dangerous threats to Android devices, users, developers, and application stores. Researchers are trying to discover new methods for malware detection because the complexity of malwares, their continuous changes, and damages caused by their attacks have increased. One of the most important challenges in detecting malware is to have a balanced dataset. In this paper, a detection method is proposed to identify malware to improve accuracy and reduce error rates by preprocessing the used dataset and balancing it. To attain these purposes, the static analysis is used to extract features of the applications. The ranking methods of features are used to preprocess the feature set and the low-effective features are removed. The proposed method also balances the dataset by using the techniques of undersampling, the Synthetic Minority Oversampling Technique (SMOTE), and a combination of both methods, which have not yet been studied among detection methods. Then, the classifiers of K-Nearest Neighbor (KNN), Support Vector Machine, and Iterative Dichotomiser 3 are used to create the detection model. The performance of KNN with SMOTE is better than the performance of the other classifiers. The obtained results indicate that the criteria of precision, recall, accuracy, F-measure, and Matthews Correlation Coefficient are over 97%. The proposed method is effective in detecting 99.49% of the malware’s existing in the used dataset and new malware.

     

Isolated word recognition by neural network models withcross-correlation coefficients for speech dynamics

This paper presents an artificial neural network (ANN) for speaker-independent isolated word speech recognition. The network consists of three subnets in concatenation. The static information within one frame of speech signal is processed in the probabilistic mapping subnet that converts an input vector of acoustic features into a probability vector whose components are estimated probabilities of the feature vector belonging to the phonetic classes that constitute the words in the vocabulary. The dynamics capturing subnet computes the first-order cross correlation between the components of the probability vectors to serve as the discriminative feature derived from the interframe temporal information of the speech signal. These dynamic features are passed for decision-making to the classification subnet, which is a multilayer perceptron (MLP). The architecture of these three subnets are described, and the associated adaptive learning algorithms are derived. The recognition results for a subset of the DARPA TIMIT speech database are reported. The correct recognition rate of the proposed ANN system is 95.5%, whereas that of the best of continuous hidden Markov model (HMM)-based systems is only 91.0%     

Using neural network ensembles for bankruptcy prediction and credit scoring

Bankruptcy prediction and credit scoring have long been regarded as critical topics and have been studied extensively in the accounting and finance literature. Artificial intelligence and machine learning techniques have been used to solve these financial decision-making problems. The multilayer perceptron (MLP) network trained by the back-propagation learning algorithm is the mostly used technique for financial decision-making problems. In addition, it is usually superior to other traditional statistical models. Recent studies suggest combining multiple classifiers (or classifier ensembles) should be better than single classifiers. However, the performance of multiple classifiers in bankruptcy prediction and credit scoring is not fully understood. In this paper, we investigate the performance of a single classifier as the baseline classifier to compare with multiple classifiers and diversified multiple classifiers by using neural networks based on three datasets. By comparing with the single classifier as the benchmark in terms of average prediction accuracy, the multiple classifiers only perform better in one of the three datasets. The diversified multiple classifiers trained by not only different classifier parameters but also different sets of training data perform worse in all datasets. However, for the Type I and Type II errors, there is no exact winner. We suggest that it is better to consider these three classifier architectures to make the optimal financial decision.     

基于机器学习算法的Android恶意程序检测系统

对于传统的恶意程序检测方法存在的缺点,针对将数据挖掘和机器学习算法被应用在未知恶意程序的检测方法进行研究。当前使用单一特征的机器学习算法无法充分发挥其数据处理能力,检测效果不佳。文中将语音识别模型与随机森林算法相结合,首次提出了综和APK文件多类特征统一建立N-gram模型,并应用随机森林算法用于未知恶意程序检测。首先,采用多种方式提取可以反映Android恶意程序行为的3类特征,包括敏感权限、DVM函数调用序列以及OpCodes特征;然后,针对每类特征建立N-gram模型,每个模型可以独立评判恶意程序行为;最后,3类特征模型统一加入随机森林算法进行学习,从而对Android程序进行检测。基于该方法实现了Android恶意程序检测系统,并对811个非恶意程序及826个恶意程序进行检测,准确率较高。综合各个评价指标,与其他相关工作对比,实验结果表明该系统在恶意程序检测准确率和有效性上表现更优。     

基于静态行为特征的细粒度Android恶意软件分类

由于Android系统的开放性,恶意软件通过实施各种恶意行为对Android设备用户构成威胁。针对目前大部分现有工作只研究粗粒度的恶意应用检测,却没有对恶意应用的具体行为类别进行划分的问题,提出了一种基于静态行为特征的细粒度恶意行为分类方法。该方法提取多维度的行为特征,包括API调用、权限、意图和包间依赖关系,并进行了特征优化,而后采用随机森林的方法实现恶意行为分类。在来自于多个应用市场的隶属于73个恶意软件家族的24 553个恶意Android应用程序样本上进行了实验,实验结果表明细粒度恶意应用分类的准确率达95.88%,综合性能优于其它对比方法。