ADCAS: Adversarial Deep Clustering of Android Streams

Abstract

The data sequences which are used in malware analysis can be attacked in many applications. However, adversarial attacks are rarely regarded in these types of data. In this paper, a deep learning-based malware clustering approach for sequential data was proposed and the impact of deploying adversarial attacks on it was investigated. An input data stream of android applications was considered as a sequence and the proposed method was tested with the extracted static features of android applications. Three android benchmark datasets, Drebin, Genome, and Contagio, are used to assess the proposed approach. In most experiments, the False Positive Rate (FPR) values of deep clustering algorithms increase to over 60% after the attack, according to the obtained results. Also, the accuracy rates drop to less than 83% in all cases. But by applying the proposed defense method the FPR values reduced while accuracy rates increased.