Combining natural language processing technology, image analysis technology and malware detection technology, a novel Android malware detection method, named BIHAD (an improved IndRNN and attention-treated DenseNet-based pipeline model), is proposed in this paper. First, in order to describe the behavior of Android malware, multiple features are used to construct a more stable discriminant method. Second, the embedding technology is introduced to map all behavior information into a vector space, which implements the extraction of the joint embedded information of semantics and images. Third, an improved Independently Recurrent Neural Network (IndRNN) is used to extract valuable texture information from the original values of the gray image, and effectively utilized the long distance information contained in the gray image. Finally, Hierarchical Attention Dense Convolutional Network (HADenseNet) is used to ensure the maximization of information flow between layers in the network, improving the utilization of semantic distribution and spatial context information. Especially, Hierarchical Attention can enhance the representational ability for key features. The comparison of the BIHAD model with several existing malware detection methods indicated a significant improvement in F-score achieved by the BIHAD.
MohdR.Z.A., ZuhairiM.F., ShadilA.Z.A., et al., Anomaly-based NIDS: A review of machine learning methods on malware detection[C], International Conference on Information and Communication Technology, IEEE (2017), 266–270.
2.
KhanJ., AbbasH. and Al-MuhtadiJ., Survey on Mobile User’s Data Privacy Threats and Defense Mechanisms ding73[J], Procedia Computer Science56(1) (2015), 376–383.
3.
IyengarS.S., IyengarS.S., IyengarS.S., et al., A Survey on Malware Detection Using Data Mining Techniques[J], Acm Computing Surveys50(3) (2017), 41.
4.
CanforaG., LorenzoA.D., MedvetE., et al., Effectiveness of Opcode ngrams for Detection of Multi Family Android Malware[C], International Conference on Availability, Reliability and Security, IEEE (2015), 333–340.
5.
Suarez-TangilG., DashS.K., AhmadiM., et al., DroidSieve: Fast and Accurate Classification of Obfuscated Android Malware[C], ACM on Conference on Data and Application Security and Privacy, ACM (2017), 309–320.
6.
SteenM.V., BosH., PohlmannN., et al., Prudent Practices for Designing Malware Experiments: Status Quo and Outlook[C], Security and Privacy. IEEE (2012), 65–79.
7.
HouS., SaasA., ChenL., et al., Deep4MalDroid: A Deep Learning Framework for Android Malware Detection Based on Linux Kernel System Call Graphs[C], Ieee/wic/acm International Conference on Web Intelligence Workshops, IEEE (2017), 104–111.
8.
NavarroL.C., NavarroA.K.W., GrégioA., et al., Leveraging ontologies and machine-learning techniques for malware analysis into Android permissions ecosystems[J], Computers & Security78 (2018), 429–453.
9.
ChenS., XueM., FanL., et al., Automated poisoning attacks and defenses in malware detection systems: An adversarial machine learning approach[J], Computers & Security73 (2018), 326–344.
10.
SuX., ZhangD., LiW., et al., A Deep Learning Approach to Android Malware Feature Learning and Detection[C], Trustcom/bigdatase/ispa, IEEE (2017), 244–251.
11.
KalashM., RochanM., MohammedN., et al., Malware Classification with Deep Convolutional Neural Networks[C], Ifip International Conference on New Technologies, Mobility and Security, IEEE (2018), 1–5.
12.
AlbasirA., JamesR.S.R., NaikK., et al., Using Deep Learning to Classify Power Consumption Signals of Wireless Devices: An Application to Cybersecurity[C], 2018 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), IEEE (2018), 2032–2036.
13.
KarbabE.M.B., DebbabiM., DerhabA., et al., MalDozer: Automatic framework for android malware detection using deep learning[J], Digital Investigation24 (2018), S48–S59.
14.
YuanZ., LuY. and XueY., Droiddetector: Android malware characterization and detection using deep learning[J], Tsinghua Science and Technology21(1) (2016), 114–123.
15.
YangZ., YangD., DyerC., et al., Hierarchical attention networks for document classification[C], Proceedings of the 2016 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies (2016), 1480–1489.
16.
HuangG., LiuZ., MaatenL.V.D., et al., Densely Connected Convolutional Networks[C], IEEE Conference on Computer Vision and Pattern Recognition, IEEE Computer Society (2017), 2261–2269.
17.
LiS., LiW., CookC., ZhuC. and GaoY., Independently Recurrent Neural Network (IndRNN): Building A Longer and Deeper RNN, 2018 IEEE/CVF Conference on Computer Vision and Pattern Recognition (1) (2018), 5457–5466. DOI: 10.1109/CVPR.2018.00572.
18.
ArpD., SpreitzenbarthM., HübnerM., GasconH. and RieckK., Drebin: Effective and Explainable Detection of Android Malware in Your Pocket, Proceedings 2014 Network and Distributed System Security Symposium45(02) (2014), 45-0765-45-0765. DOI: 10.14722/ndss.2014.23247.
19.
SuJ., VasconcellosV.D., PrasadS., et al., Lightweight classification of IoT malware based on image recognition[C], 2018 IEEE 42nd Annual Computer Software and Applications Conference (COMPSAC), IEEE2 (2018), 664–669.
20.
YangM. and WenQ., Detecting android malware by applying classification techniques on images patterns[C], IEEE, International Conference on Cloud Computing and Big Data Analysis, IEEE (2017), 344–347.
21.
RubioJ.J., Ricardo CruzD., EliasI., et al., ANFIS system for classification of brain signals[J], Journal of Intelligent & Fuzzy Systems 2019. DOI: 10.3233/JIFS-190207
22.
de Jesús RubioJ., SOFMLS: online self-organizing fuzzy modified least-squares network[J], IEEE Transactions on Fuzzy Systems17(6) (2009), 1296–1309.
23.
GiapC.N., SonL.H. and ChiclanaF., Dynamic structural neural network[J], Journal of Intelligent & Fuzzy Systems34(4) (2018), 2479–2490.
24.
de Jesús RubioJ., Error convergence analysis of the SUFIN and CSUFIN[J], Applied Soft Computing72 (2018), 587–595.
25.
WeiF., LiY., RoyS., OuX. and ZhouW., Deep Ground Truth Analysis of Current Android Malware. In Detection of Intrusions and Malware, and Vulnerability Assessment (Vol. 1, (2017), pp. 252–276). DOI: 10.1007/978-3-319-60876-1_12.
26.
AllixK., BissyandéT.F., KleinJ., et al., Androzoo: Collecting millions of android apps for the research community[C], 2016 IEEE/ACM 13th Working Conference on Mining Software Repositories (MSR), IEEE (2016), 468–471.
27.
MaiorcaD., AriuD., CoronaI., AresuM. and GiacintoG., Stealth attacks: An extended insight into the obfuscation effects on Android malware, Computers and Security (2015), 51(March 2014), 16–31. DOI: 10.1016/j.cose.2015.02.007
28.
LinZ., FengM., SantosC.N., et al., A structured self-attentive sentence embedding[J]. arXiv preprint arXiv:1703.03130, 2017.
29.
VaswaniA., ShazeerN., ParmarN., et al., Attention is all you need[C], Advances in Neural Information Processing Systems (2017), 5998–6008.
30.
LiC., ZhuR., NiuD., MillsK., ZhangH. and KinawiH., Android Malware Detection based on Factorization Machine. (May). (2018). Retrieved from http://arxiv.org/abs/1805.11843
31.
YusofM., SaudiM.M. and RidzuanF., A new mobile botnet classification based on permission and API calls[C], Emerging Security Technologies (EST), 2017 Seventh International Conference on. IEEE (2017), 122–127.
32.
KarbabE.M.B., DebbabiM., AlrabaeeS., et al., DySign: Dynamic fingerprinting for the automatic detection of Android malware[C], Malicious and Unwanted Software (MALWARE), 2016 11th International Conference on. IEEE (2016), 1–8.
33.
NarayananA., SohC., ChenL., et al., apk2vec: Semisupervised multi-view representation learning for profiling Android applications[C], 2018 IEEE International Conference on Data Mining (ICDM). IEEE (2018), 357–366.
34.
MartínA., Rodríguez-FernándezV. and CamachoD., CANDYMAN: Classifying Android malware families by modelling dynamic traces with Markov chains[J], Engineering Applications of Artificial Intelligence74 (2018), 121–13.
35.
MassarelliL., AnielloL., CiccotelliC., QuerzoniL., UcciD. and BaldoniR., Android malware family classification based on resource consumption over time. Proceedings of the 2017 12th International Conference on Malicious and Unwanted Software, MALWARE 2017 (2018), 2018–January, 31–38.
36.
PektaşA. and AcarmanT., Learning to detect Android malware via opcode sequences[J], Neurocomputing2019.
