DeepCatra: Learning flow‐ and graph‐based behaviours for Android malware detection
Abstract As Android malware grows and evolves, deep learning has been introduced into malware detection, resulting in great effectiveness. Recent work is considering hybrid models and multi‐view learning. However, they use only simple features, limiting the accuracy of these approaches in practice....
| Main Authors: | , , , , |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
Hindawi-IET
2023-01-01
|
| Series: | IET Information Security |
| Online Access: | https://doi.org/10.1049/ise2.12082 |
| _version_ | 1797422830320615424 |
|---|---|
| author | Yafei Wu Jian Shi Peicheng Wang Dongrui Zeng Cong Sun |
| author_facet | Yafei Wu Jian Shi Peicheng Wang Dongrui Zeng Cong Sun |
| author_sort | Yafei Wu |
| collection | DOAJ |
| description | Abstract As Android malware grows and evolves, deep learning has been introduced into malware detection, resulting in great effectiveness. Recent work is considering hybrid models and multi‐view learning. However, they use only simple features, limiting the accuracy of these approaches in practice. This study proposes DeepCatra, a multi‐view learning approach for Android malware detection, whose model consists of a bidirectional LSTM (BiLSTM) and a graph neural network (GNN) as subnets. The two subnets rely on features extracted from statically computed call traces leading to critical APIs derived from public vulnerabilities. For each Android app, DeepCatra first constructs its call graph and computes call traces reaching critical APIs. Then, temporal opcode features used by the BiLSTM subnet are extracted from the call traces, while flow graph features used by the GNN subnet are constructed from all call traces and inter‐component communications. We evaluate the effectiveness of DeepCatra by comparing it with several state‐of‐the‐art detection approaches. Experimental results on over 18,000 real‐world apps and prevalent malware show that DeepCatra achieves considerable improvement, for example, 2.7%–14.6% on the F1 measure, which demonstrates the feasibility of DeepCatra in practice. |
| first_indexed | 2024-03-09T07:39:03Z |
| format | Article |
| id | doaj.art-29ee6f7762024732b0d81935d88e0d07 |
| institution | Directory Open Access Journal |
| issn | 1751-8709 1751-8717 |
| language | English |
| last_indexed | 2024-03-09T07:39:03Z |
| publishDate | 2023-01-01 |
| publisher | Hindawi-IET |
| record_format | Article |
| series | IET Information Security |
| spelling | doaj.art-29ee6f7762024732b0d81935d88e0d072023-12-03T05:08:57ZengHindawi-IETIET Information Security1751-87091751-87172023-01-0117111813010.1049/ise2.12082DeepCatra: Learning flow‐ and graph‐based behaviours for Android malware detectionYafei Wu0Jian Shi1Peicheng Wang2Dongrui Zeng3Cong Sun4School of Cyber Engineering Xidian University Xi'an ChinaSchool of Cyber Engineering Xidian University Xi'an ChinaSchool of Cyber Engineering Xidian University Xi'an ChinaPalo Alto Networks Santa Clara California USASchool of Cyber Engineering Xidian University Xi'an ChinaAbstract As Android malware grows and evolves, deep learning has been introduced into malware detection, resulting in great effectiveness. Recent work is considering hybrid models and multi‐view learning. However, they use only simple features, limiting the accuracy of these approaches in practice. This study proposes DeepCatra, a multi‐view learning approach for Android malware detection, whose model consists of a bidirectional LSTM (BiLSTM) and a graph neural network (GNN) as subnets. The two subnets rely on features extracted from statically computed call traces leading to critical APIs derived from public vulnerabilities. For each Android app, DeepCatra first constructs its call graph and computes call traces reaching critical APIs. Then, temporal opcode features used by the BiLSTM subnet are extracted from the call traces, while flow graph features used by the GNN subnet are constructed from all call traces and inter‐component communications. We evaluate the effectiveness of DeepCatra by comparing it with several state‐of‐the‐art detection approaches. Experimental results on over 18,000 real‐world apps and prevalent malware show that DeepCatra achieves considerable improvement, for example, 2.7%–14.6% on the F1 measure, which demonstrates the feasibility of DeepCatra in practice.https://doi.org/10.1049/ise2.12082 |
| spellingShingle | Yafei Wu Jian Shi Peicheng Wang Dongrui Zeng Cong Sun DeepCatra: Learning flow‐ and graph‐based behaviours for Android malware detection IET Information Security |
| title | DeepCatra: Learning flow‐ and graph‐based behaviours for Android malware detection |
| title_full | DeepCatra: Learning flow‐ and graph‐based behaviours for Android malware detection |
| title_fullStr | DeepCatra: Learning flow‐ and graph‐based behaviours for Android malware detection |
| title_full_unstemmed | DeepCatra: Learning flow‐ and graph‐based behaviours for Android malware detection |
| title_short | DeepCatra: Learning flow‐ and graph‐based behaviours for Android malware detection |
| title_sort | deepcatra learning flow and graph based behaviours for android malware detection |
| url | https://doi.org/10.1049/ise2.12082 |
| work_keys_str_mv | AT yafeiwu deepcatralearningflowandgraphbasedbehavioursforandroidmalwaredetection AT jianshi deepcatralearningflowandgraphbasedbehavioursforandroidmalwaredetection AT peichengwang deepcatralearningflowandgraphbasedbehavioursforandroidmalwaredetection AT dongruizeng deepcatralearningflowandgraphbasedbehavioursforandroidmalwaredetection AT congsun deepcatralearningflowandgraphbasedbehavioursforandroidmalwaredetection |