Browse > Article
http://dx.doi.org/10.3837/tiis.2019.07.018

Deep Learning in Drebin: Android malware Image Texture Median Filter Analysis and Detection  

Luo, Shi-qi (School of Computer, Hubei Polytechnic University)
Ni, Bo (School of Computer, Hubei Polytechnic University)
Jiang, Ping (School of Computer, Hubei Polytechnic University)
Tian, Sheng-wei (School of Information Science and Engineering, Xinjiang University)
Yu, Long (School of Information Science and Engineering, Xinjiang University)
Wang, Rui-jin (School of Computer Science and Engineering, University of Electronic Science and Technology of China)
Publication Information
KSII Transactions on Internet and Information Systems (TIIS) / v.13, no.7, 2019 , pp. 3654-3670 More about this Journal
Abstract
This paper proposes an Image Texture Median Filter (ITMF) to analyze and detect Android malware on Drebin datasets. We design a model of "ITMF" combined with Image Processing of Median Filter (MF) to reflect the similarity of the malware binary file block. At the same time, using the MAEVS (Malware Activity Embedding in Vector Space) to reflect the potential dynamic activity of malware. In order to ensure the improvement of the classification accuracy, the above-mentioned features(ITMF feature and MAEVS feature)are studied to train Restricted Boltzmann Machine (RBM) and Back Propagation (BP). The experimental results show that the model has an average accuracy rate of 95.43% with few false alarms. to Android malicious code, which is significantly higher than 95.2% of without ITMF, 93.8% of shallow machine learning model SVM, 94.8% of KNN, 94.6% of ANN.
Keywords
malware; Image Texture Median Filter; Malware Activity Embedding in Vector Space;
Citations & Related Records
Times Cited By KSCI : 1  (Citation Analysis)
연도 인용수 순위
1 Schultz M G, Eskin E, Zadok F, et al., "Data mining methods for detection of new malicious executables," in Proc. of Security and Privacy, 2001. S&P 2001. Proceedings. 2001 IEEE Symposium on. IEEE, 38-49, 2001.
2 Zerina Masetic, Subasi A , Azemovic J, "Malicious Web Sites Detection using C4.5 Decision Tree," in Proc. of Iusscrg, Fourth Regional Conference on Soft Computing, 2016.
3 Zhao G, Wang P, Wang X, et al., "The Detection Method for Two-dimensional Barcode Malicious URL Based on the Decision Tree," Information Security & Technology, 2014.
4 Alam M S, Vuong S T, "Random Forest Classification for Detecting Android Malware," Green Computing and Communications. IEEE, 663-669, 2013.
5 Liu Z, Juan D U, Zhian Y I, "Application of a Improved Categorization Algorithm in the Malicious Information Filtering," Microcomputer Applications, 2011.
6 Bengio Y, "Learning deep architectures for AI," Foundations and trends in machine learning, 2(1), 1-127, 2009.   DOI
7 Luo Shiqi, Tian Shengwei, Yu Long, Yu Jiong and Sun Hua, "Android malicious code Classification using Deep Belief Network," KSII Transactions on Internet and Information Systems, 12(1), 454-475, 2018.   DOI
8 Luo Shiqi, Tian Shengwei,et., "Research on malicious code classification algorithm of stacked auto encoder," Application Research of Computers, 35(1), 261-265, 2018.
9 Luo Shiqi, Tian Shengwei ,et. "Research strategy of classify malicious code into families on the method of deep belief networks," Journal of Chinese Computer Systems, 38(11), 2465-2470, 2017
10 Luo Shiqi, Tian Shengwei, Yu Long, Yu Jiong and Sun Hua, "Android malware detection based on texture fingerprint and malware activity vector space," Journal of Computer Application, 38(4), 1058-1063, 2018.
11 Balaganesh D, Chakrabarti A, Midhunchakkaravarthy D, "Smart Devices Threats, Vulnerabilities and Malware Detection Approaches: A Survey," EJERS, 3(2), 7, 2018.   DOI
12 Elhadi A A E, Maarof M A, Osman A H, "Malware detection based on hybrid signature behaviour application programming interface call graph," American Journal of Applied Sciences, 9(3), 283-288, 2012.   DOI
13 Li Jian,Wang Zheng et., "An Android Malware Detection System Based on Feature Fusion," Chinese Journal of Electronics, 27(6), 1206-1213, 2018.   DOI
14 Seshagiri P, Vazhayil A,Sriram P, "AMA: Static Code Analysis of Web Page for the Detection of Malicious Scripts ," Procedia Computer Science, 93, 768-773, 2016.   DOI
15 Willems C, Holz T, Freiling F, "Toward Automated Dynamic Malware Analysis Using CWSandbox," IEEE Security & Privacy Magazine, 5(2), 32-39, 2007.   DOI
16 Park Y, Reeves D, Mulukutla V, et al., "Fast malware classification by automated behavioral graph matching," in Proc. of CSIIRW '10 Proceedings of the Sixth Annual Workshop on CyberSecurity and Information Intelligence Research, 1-4, 2010.
17 Chen K Z, Johnson N, D'Silva V, et al., "Contextual Policy Enforcement in Android Applications with Permission Event Graphs," Heredity, 110(6), 586, 2013.   DOI
18 Christodorescu M, Jha S, Seshia S A, et al., "Semantics-aware malware detection," in Proc. of Security and Privacy, 2005 IEEE Symposium on, 32-46, 2005.
19 Fredrikson M, Jha S, Christodorescu M, et al., "Synthesizing Near-Optimal Malware Specifications from Suspicious Behaviors," in Proc. of IEEE Symposium on Security and Privacy. IEEE Computer Society, 45-60, 2010.
20 Kolbitsch C, Comparetti P M, Kruegel C, et al., "Effective and efficient malware detection at the end host," in Proc. of 18th Usenix Security Symposium, 351-366, Montreal, Canada, August10-14, 2009.
21 Kruegel C, Toth T, "Using Decision Trees to Improve Signature-Based Intrusion Detection," Lecture Notes in Computer Science, 2820, 173-191, 2003.
22 Venkitaraman R, Gupta G, "Static program analysis of embedded executable assembly code," in Proc. of International Conference on Compilers, Architecture, and Synthesis for Embedded Systems, CASES 2004, Washington Dc, Usa, 157-166, 2004.
23 Zhang B, Li Q, Ma Y, "Research on dynamic heuristic scanning technique and the application of the malicious code detection model," Information Processing Letters, 117, 19-24, 2017.   DOI
24 Chen Y Q, Xiao-Ping W U, Fu Y, et al., "Active Defense strategies selection for network mixed malicious action," in Proc. of International Workshop on Cloud Computing & Information Security, 52(1391), 336-340, 2013.
25 Aijun Jiang, Zhifeng Liu, Qinglong Kong, Bo Zhang, Tong Yao, "Scanning device, cloud management device, method and system for checking and killing malicious programs," US, US20150317478 A1, 2015.
26 Arp D, Spreitzenbarth M, Hubner M, et al., "DREBIN: Effective and Explainable Detection of Android Malware in Your Pocket," in Proc. of Network and Distributed System Security Symposium, 2014.