A Two-Layer Deep Learning Method for Android Malware Detection Using Network Traffic
Because of the characteristic of openness and flexibility, Android has become the most popular mobile platform. However, it has also become the most targeted system by mobile malware. It is necessary for the users to have a fast and reliable detection method. In this paper, a two-layer method is pro...
| Main Authors: | , , , , |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
IEEE
2020-01-01
|
| Series: | IEEE Access |
| Subjects: | |
| Online Access: | https://ieeexplore.ieee.org/document/9136685/ |
| _version_ | 1818444199672938496 |
|---|---|
| author | Jiayin Feng Limin Shen Zhen Chen Yuying Wang Hui Li |
| author_facet | Jiayin Feng Limin Shen Zhen Chen Yuying Wang Hui Li |
| author_sort | Jiayin Feng |
| collection | DOAJ |
| description | Because of the characteristic of openness and flexibility, Android has become the most popular mobile platform. However, it has also become the most targeted system by mobile malware. It is necessary for the users to have a fast and reliable detection method. In this paper, a two-layer method is proposed to detect malware in Android APPs. The first layer is permission, intent and component information based static malware detection model. It combines the static features with fully connected neural network to detect the malware and test its effectiveness through experiment, the detection rate of the first layer is 95.22%. Then the result (benign APPs from the first layer) is input into the second layer. In the second layer, a new method CACNN which cascades CNN and AutoEncoder, is used to detect malware through network traffic features of APPs. The detection rate of the second layer is 99.3% in binary classification (2-classifier). Moreover, the new two-layer model can also detect malware by its category (4-classifier) and malicious family (40-classifier). The detection rates are 98.2% and 71.48% respectively. The experimental results show that our two-layer method not only can achieve semi-supervise learning, but also can effectively improve the detection rate of malicious Android APPs. |
| first_indexed | 2024-12-14T19:12:09Z |
| format | Article |
| id | doaj.art-2265927a83d14c70bf9c47737b3e84de |
| institution | Directory Open Access Journal |
| issn | 2169-3536 |
| language | English |
| last_indexed | 2024-12-14T19:12:09Z |
| publishDate | 2020-01-01 |
| publisher | IEEE |
| record_format | Article |
| series | IEEE Access |
| spelling | doaj.art-2265927a83d14c70bf9c47737b3e84de2022-12-21T22:50:42ZengIEEEIEEE Access2169-35362020-01-01812578612579610.1109/ACCESS.2020.30080819136685A Two-Layer Deep Learning Method for Android Malware Detection Using Network TrafficJiayin Feng0https://orcid.org/0000-0003-2687-2280Limin Shen1https://orcid.org/0000-0002-9325-2279Zhen Chen2https://orcid.org/0000-0003-4424-7315Yuying Wang3Hui Li4School of Information Science and Engineering, Yanshan University, Qinhuangdao, ChinaSchool of Information Science and Engineering, Yanshan University, Qinhuangdao, ChinaSchool of Information Science and Engineering, Yanshan University, Qinhuangdao, ChinaSchool of Information Science and Engineering, Yanshan University, Qinhuangdao, ChinaSchool of Information Science and Engineering, Yanshan University, Qinhuangdao, ChinaBecause of the characteristic of openness and flexibility, Android has become the most popular mobile platform. However, it has also become the most targeted system by mobile malware. It is necessary for the users to have a fast and reliable detection method. In this paper, a two-layer method is proposed to detect malware in Android APPs. The first layer is permission, intent and component information based static malware detection model. It combines the static features with fully connected neural network to detect the malware and test its effectiveness through experiment, the detection rate of the first layer is 95.22%. Then the result (benign APPs from the first layer) is input into the second layer. In the second layer, a new method CACNN which cascades CNN and AutoEncoder, is used to detect malware through network traffic features of APPs. The detection rate of the second layer is 99.3% in binary classification (2-classifier). Moreover, the new two-layer model can also detect malware by its category (4-classifier) and malicious family (40-classifier). The detection rates are 98.2% and 71.48% respectively. The experimental results show that our two-layer method not only can achieve semi-supervise learning, but also can effectively improve the detection rate of malicious Android APPs.https://ieeexplore.ieee.org/document/9136685/Androidmalware detectiondeep learningnetwork traffic |
| spellingShingle | Jiayin Feng Limin Shen Zhen Chen Yuying Wang Hui Li A Two-Layer Deep Learning Method for Android Malware Detection Using Network Traffic IEEE Access Android malware detection deep learning network traffic |
| title | A Two-Layer Deep Learning Method for Android Malware Detection Using Network Traffic |
| title_full | A Two-Layer Deep Learning Method for Android Malware Detection Using Network Traffic |
| title_fullStr | A Two-Layer Deep Learning Method for Android Malware Detection Using Network Traffic |
| title_full_unstemmed | A Two-Layer Deep Learning Method for Android Malware Detection Using Network Traffic |
| title_short | A Two-Layer Deep Learning Method for Android Malware Detection Using Network Traffic |
| title_sort | two layer deep learning method for android malware detection using network traffic |
| topic | Android malware detection deep learning network traffic |
| url | https://ieeexplore.ieee.org/document/9136685/ |
| work_keys_str_mv | AT jiayinfeng atwolayerdeeplearningmethodforandroidmalwaredetectionusingnetworktraffic AT liminshen atwolayerdeeplearningmethodforandroidmalwaredetectionusingnetworktraffic AT zhenchen atwolayerdeeplearningmethodforandroidmalwaredetectionusingnetworktraffic AT yuyingwang atwolayerdeeplearningmethodforandroidmalwaredetectionusingnetworktraffic AT huili atwolayerdeeplearningmethodforandroidmalwaredetectionusingnetworktraffic AT jiayinfeng twolayerdeeplearningmethodforandroidmalwaredetectionusingnetworktraffic AT liminshen twolayerdeeplearningmethodforandroidmalwaredetectionusingnetworktraffic AT zhenchen twolayerdeeplearningmethodforandroidmalwaredetectionusingnetworktraffic AT yuyingwang twolayerdeeplearningmethodforandroidmalwaredetectionusingnetworktraffic AT huili twolayerdeeplearningmethodforandroidmalwaredetectionusingnetworktraffic |