Mobile Malware Research Articles

Experts still needed: boosting long-term android malware detection with active learning

The continuous evolution of cyber threats imposes a critical challenge to malware detection systems, so operational detection solutions in real-world settings must keep up-to-date malware knowledge databases. Machine learning-based solutions are not exempt from this requirement as handling concept drift constitutes the primary building block for keeping high detection performance in the long term. However, maintaining non-stationary malware detection models is highly demanding due to the high cost of labeling. This study applies several active learning-based approaches for maintaining a non-stationary model for Android malware detection in a 7-year-long time frame and conducts a comprehensive analysis to understand the impact of feature space selection, different data balancing techniques, and timestamping methods, utilized for locating the instances along the historical timeline, on the model’s detection performance over time. The detection accuracy and labeling costs are compared with various baselines. Additionally, the study investigates the resilience of such models against noisy labeling, a common problem in production environments due to unintentional expert errors and adversarial attacks. This research fills a significant gap in the literature by conducting a comprehensive analysis of active learning approaches to address concept drift in non-stationary settings established for mobile malware detection.

An intelligent obfuscated mobile malware detection using deep supervised learning algorithms

Obfuscated mobile malware (OMM) is a malicious software in mobile that hides to avoid detection and annihilation. These types of malwares are thorny to identify due to their inevitable nature. Deep learning (DL) algorithms are the most desirable to detect obfuscated malware based on the ‘n’ number of iterations with adjustable weights and neurons. This study investigates the accurate detection of OMM using significant DL algorithms such as multi-layer perceptron (MLP), self-organizing maps (SOM), long short-term memory (LSTM) networks, auto encoders (AE), and convolutional neural network (CNN) based on appropriate parameter tuning. The dataset taken for the study is CICMalMem2022 that contains 58,596 samples with 57 features which is basically designed for OMM detection. The dataset comprises Spyware, Ransomware, Trojan horse, and Benign. The DL models are evaluated based on performance metrics such as precision, recall, accuracy, training accuracy, test accuracy, validation accuracy, training loss, validation loss and receiver operating characteristic (ROC) curve. Based on the experimental evaluation, the study reveals that LSTM outperforms with 100% accuracy and MLP achieves 99.9% accuracy in detecting and classifying the OMM using deep supervised learning (SL) mechanism.

Strengthening LLM ecosystem security: Preventing mobile malware from manipulating LLM-based applications

Large language model (LLM) platform vendors have begun to make their models available for developers to build for different use cases. However, the emergence of LLM-based applications may raise security and privacy issues, and even LLM-based applications may be susceptible to malware. To strengthen LLM ecosystem security, it's crucial to develop malware detection algorithms for various platforms. We pay attention to Android malware because the Android platform is widely used and vulnerable. Existing single feature based-solutions cannot effectively describe applications, and aged models fail to detect new malware as Android platform develops and malware evolves. Therefore, existing detection methods are ill-suited for evolved malware that may manipulate LLM-based applications. To tackle the above problems, we design EvolveDroid, an anti-aging Android malware detection system. On the one hand, EvolveDroid utilizes different view features to reflect malware behavior from multiple dimensions, and maximizes the advantages of each feature type through feature aggregation. On the other hand, EvolveDroid learns good representation of applications through contrastive learning and generates pseudo labels by measuring the distance between unknown samples and existing samples for model updating. Extensive evaluations show that EvolveDroid outperforms state-of-the-art (sota) solutions in detection performance and slowing model aging.

MetaNet: Interpretable unknown mobile malware identification with a novel meta-features mining algorithm

The continuous emergence of malware has threatened to the Android platform and user privacy. With the evolution of the Android system and malware, it is challenging to design a method that can accurately identify the categories of sophisticated malware, including known and unknown families, as well as their obfuscated variants, given that they may be newly emerging and lack available detection knowledge. Although some methods try to use anomaly detection and zero-shot technology to identify unseen applications, they are limited to binary classification or lack the robustness, stability, universality, and interpretability in multi-class identification. To this end, we first propose a generic meta-features mining algorithm, which can discover the potential relationships between samples belonging to the same category. Then we present metaNet, a novel method leveraging meta-features to identify sophisticated Android malware. Specifically, metaNet is mainly powered by four components: (i) mExtractor is a feature collector to obtain the static and dynamic features. (ii) mProcessor is taking unique meta-features of each category from extracted features. (iii) mLearner is a machine learning suite that leverages features and meta-features to design and train a classifier called HSU-Net. (iv) mEnforcer is a flexible deployer that identifies categories of malware families in the real world. We implement a prototype of metaNet with 15K lines of Python code and compare it with state-of-the-art (SOTA) methods. The results show that it can not only achieve superior performance in terms of known families (99.52% of accuracy) and unknown families (99.31% of accuracy trained with 80% known families) for binary classification, but also perform well in multi-class identification, i.e., 99.05% and 93.45% of accuracy for known and unknown families, respectively. Furthermore, we deploy and evaluate metaNet in the real world. It can identify applications over an acceptable time and memory overheads, i.e., average of 11.8 s and 56 MB per sample with a size of 8 MB. Also, the few-shot detection and feature perturbation experiments reflect its robustness and stability benefiting from meta-features. Finally, we collect the traffic of 112 decentralized applications (DApps) belonging to 16 categories, such as finance and health, and evaluated metaNet in DApp identification. The results illustrate its applicability across various tasks. That is, it can accurately classify 94.6% and 81.36% of DApp flows in all-known and 80%-known DApp scenarios, respectively, outperforming the SOTA methods.

A novel method of detecting malware on Android mobile devices with explainable artificial intelligence

The increasing prevalence of malware targeting android mobile devices has raised significant concerns regarding user privacy and security. In response, effective methods for malware classification and detection are crucial to protect users from malicious applications. This paper presents an approach that leverages deep learning techniques and explainable artificial intelligence (XAI) for android mobile malware classification and detection. Convolutional neural networks (CNNs) are deep learning model that has shown impressive performance in several application areas, including image and text classification. In the context of android mobile malware, CNNs have shown promising results in capturing intricate patterns and features inherent in malware samples. By training these models on large datasets of benign and malicious applications, accurate classification can be achieved. To enhance transparency and interpretability, XAI techniques are integrated into the classification process. These techniques provide insights into the decision-making process of the deep learning models, enabling the identification of critical features and characteristics that contribute to the classification results. This research, by combining deep learning and XAI methods, presents a fresh strategy for identifying and categorizing Android malware. This research paper will focus on a fascinating CNN-based malware categorization technique.

Mobile Malware Detection using Machine Learning Classifiers

In today world the mobile malware shows the significant threat to the security and privacy of the society using smartphones. These malware aims to access the sensitive data and harm the devices of users. This paper conducts a comprehensive comparison between the various machine learning and traditional methods for mobile malware detection based on the research papers published by the authors. Signature-based detection depends upon the predefined and common patterns, while the anomaly based techniques analyse the deviation from the regular normal behaviour. This study discusses the strengths and limitations of different approaches and highlights the need for adopting the malware detection methods to fight the growing threats. It also examines the role of machine learning algorithms, like Decision Trees, Random Forests, Convolutional Neural Networks, Support Vector Machines, and Naïve Bayes, for better malware detection. Latest findings and research highlights the importance of the continuing innovation to fight the emerging threat to the user privacy, data and security due to malwares. Keywords: Mobile Malware, Artificial Intelligence, Virus, Signature-based Detection, Machine Learning

A Comparative Analysis of Malware Detection Methods Traditional vs. Machine Learning

Mobile devices have been the target of malicious software since their beginnings. Two known types
 of malware threats can intrude into mobile, independently injected applications and fraudulent
 applications that are developed to breach the security of mobile devices. Mostly these fraudulent
 applications access data using API calls and permission requests. API calls and permission requests
 are important for smooth conversation between mobile devices and database servers. This research
 proposes an efficient classification model that concatenates API calls and permission requests to
 detect malicious applications. We have used a dataset that contained more than 15 thousand Android
 devices’ malware. We have divided data into three groups to differentiate between the malicious
 permission requests and malicious API calls with normal permission requests and normal API calls.
 To increase the probability of recognizing Android malware applications, we develop three distinct
 grouping strategies for selecting the most valuable API calls that are obscure, critical, and obstreperous and are chosen because Android apps extensively use several application programming interfaces (APIs). According to the results, malware applications require authorizations to access confidential information very frequently than normal Android applications do. Also, malicious Android
 applications raise a diverse set of API calls to access sensitive data, evidenced by malware applications making a distinct set of API calls. Our proposed method attains an F-score of 94.04%, which suggests that it is efficient at discovering mobile malware applications. Our model can be of significant assistance in conducting mobile application analysis and forensic investigations into malware.

Mobile based Malware Detection using Artificial Intelligence Techniques a review

Malware attacks on mobile devices are becoming more common and more complicated every year. Malware writers see the open-source Android app as their main target because so many people use it. Artificial intelligence is used by most of the literature's mobile malware detection methods to find ransomware. Our research, on the other hand, makes it clear that most of the earlier studies used different metrics and models, as well as different datasets and classification features that came from static, dynamic, or hybrid analysis strategies. This makes comparing the different suggested detection methods more difficult and may also make the results less certain. The goal of this work is to solve the problem of AI-powered malware detection by sorting current methods and approaches into three groups: the type of dataset, the type of detection method used (machine learning models, deep learning models, and Behavioral Analysis model), and how well the method works. In this way, we suggest a convergent plan that can be used as a basis for future methods of finding malware on Android and as a solid standard for artificial intelligence work in this area.

ANDROIDGYNY: Reviewing Clustering Techniques for Android Malware Family Classification

Thousands of malicious applications (apps) are created daily, modified with the aid of automation tools, and released on the World Wide Web. Several techniques have been applied over the years to identify whether an APK is malicious or not. The use of these techniques intends to identify unknown malware mainly by calculating the similarity of a sample with previously grouped, already known families of malicious apps. Thus, high rates of accuracy would enable several countermeasures: from further quick detection to the development of vaccines and aid for reverse engineering new variants. However, most of the literature consists of limited experiments—either short-term and offline or based exclusively on well-known malicious apps’ families. In this paper, we explore the use of malware phylogeny, a term borrowed from biology, consisting of the genealogical study of the relationship between elements and families. Also, we investigate the literature on clustering techniques applied to mobile malware classification and discuss how researchers have been setting up their experiments.

Impact of cybersecurity awareness on mobile malware propagation: A dynamical model

Despite the recent increase in mass media attention to mobile malware, it is still one of the major mobile security threats due to the lack of cybersecurity awareness. The compartment mode can divide the individuals into different states whose name is often a combination of the state names. To explore the impact of the security awareness level of users on susceptible and infected mobile devices, we propose a novel Unaware-Susceptible Aware-Susceptible Latent Breakout Quarantine Recovery (SuSaLBQR) compartment model for mobile malware propagation. In this model, the susceptible mobile devices are divided into two sub-classes: the Su compartment and the Sa compartment depending on the security awareness level of their corresponding users. Based on some reasonable assumptions, a dynamical system is proposed to describe mobile malware propagation behaviors. To explore how malware ultimately spreads, two distinct equilibria (i.e., the malware-spreading and malware-free equilibria) are obtained. Furthermore, the global asymptotic stabilities of those two equilibria are proved by constructing the Lyapunov functions, respectively. The above analysis can provide a theoretical basis for controlling mobile malware propagation. Finally, based on the theoretical and numerical results, a discussion is provided. We find that the above two factors can significantly affect the presence and prevalence of malware in mobile networks.

MONDEO-Tactics5G: Multistage botnet detection and tactics for 5G/6G networks

Mobile malware is a malicious code specifically designed to target mobile devices to perform multiple types of fraud. The number of attacks reported each day is increasing constantly and is causing an impact not only at the end-user level but also at the network operator level. Malware like FluBot contributes to identity theft and data loss but also enables remote Command & Control (C2) operations, which can instrument infected devices to conduct Distributed Denial of Service (DDoS) attacks. Current mobile device-installed solutions are not effective, as the end user can ignore security warnings or install malicious software. This article designs and evaluates MONDEO-Tactics5G - a multistage botnet detection mechanism that does not require software installation on end-user devices, together with tactics for 5G network operators to manage infected devices. We conducted an evaluation that demonstrates high accuracy in detecting FluBot malware, and in the different adaptation strategies to reduce the risk of DDoS while minimising the impact on the clients' satisfaction by avoiding disrupting established sessions.

Broad learning: A GPU-free image-based malware classification

In today’s cybersecurity landscape, software security companies encounter a significant challenge in detecting new and unknown malware. Despite the introduction of various machine learning and deep learning tools designed to identify malicious software based on static and dynamic features, achieving the desired level of accuracy remains elusive. This challenge is exacerbated by factors such as encryption, packing, limited distribution, and uneven allocation of malware samples across different families. Moreover, deep learning techniques demand substantial time, computational resources (specifically GPUs), and expertise from data scientists for practical malware analysis. In response to these challenges, we propose a novel GPU-free approach called Image-based Malware Classification using Broad Learning (IMCBL) to address these issues. Our method integrates visualization, feature decomposition, and broad learning architecture to enhance malware detection and classification. We convert raw malware binaries into images, reducing the necessity for extensive feature engineering. These images transform using truncated Singular Value Decomposition (SVD) to reduce the feature vector size, expediting the training process while mitigating model overfitting. The transformed feature vector is then input into our proposed Broad Learning (BL) system, which facilitates malware detection and classification. The BL architecture, structured as a flat network mapping original inputs to feature nodes and expanding the structure in enhancement nodes, ensures efficient and effective classification without the need for retraining. This dynamic and incremental learning capability sets IMCBL apart, making it superior to existing deep learning architectures. To validate our approach, we conducted extensive experiments using five benchmark malware datasets, including the Microsoft Windows malware challenge dataset, the Malimg Windows malware dataset, the IoT-Android mobile malware dataset, the Big Windows malware dataset, and an obfuscated Windows malware dataset. The results demonstrate IMCBL’s remarkable success in classifying most malware samples, even under obfuscation attacks, performing comparably or outperforming current methods using similar benchmarks. Specifically, IMCBL achieved 95.58% accuracy for the Microsoft Windows malware dataset, 97.64% accuracy for the Malimg Windows malware dataset, 96.51% accuracy for IoT Android malware datasets, and 96.19% accuracy for the extensive Windows malware dataset. Additionally, IMCBL demonstrated 93.04% accuracy for an obfuscated Windows malware dataset, which contains both packed and unpacked malware samples. Notably, IMCBL exhibits an exponential advantage in computation overhead, including training and prediction time, when compared to traditional machine learning and advanced state-of-the-art deep learning architectures such as VGG16, ResNet50, and InceptionV3.

AAGAN: Android Malware Generation System Based on Generative Adversarial Network

With the rapid evolution of mobile malware, especially Android malware, machine learning (ML)-based Android malware detection systems have drawn massive attention. Although ML algorithms have recently led to many vital breakthroughs in malware detection, they are still particularly vulnerable to adversarial example (AE) attacks. By applying small random perturbations (e.g. simply modifying different kinds of features from the application’s manifest file), an AE attack can cause the misclassification of legitimate applications. This paper proposes AAGAN, an automated Android malware generation system based on Generative Adversarial Networks (GAN) that can successfully deceive current ML detectors. Our experiment results indicate that AEs generated by our system can flip the prediction of the state-of-the-art detection algorithms in 99% of cases using a real-world dataset. To defend against AE attacks, we improve the robustness of our detection system by alternatively retraining with these newly generated AEs. Surprisingly, after retraining five times, AAGAN can achieve an 89% success rate in bypassing our malware detection system.

A Smishing Detection Method Based on SMS Contents Analysis and URL Inspection Using Google Engine and VirusTotal

Smishing is the delivery of phishing content to mobile users via a short message service (SMS). SMS allows cybercriminals to reach out to mobile end users in a new way, attempting to deliver phishing messages, mobile malware, and online scams that appear to be from a trusted brand. This paper proposes a new method for detecting smishing by combining two detection methods. The first method is uniform resource locators (URL) analysis, which employs a novel combination of the Google engine and VirusTotal. The second method involves examining SMS content to extract efficient features and classify messages as ham or smishing based on keywords contained within them using four well-known classifiers: support vector machine (SVM), random forest (RF), adaptive boosting (AdaBoost), and extreme gradient boosting (XGBoost). The best results of the proposed method were 98.5%, 96.9%, 93.1%, and 95.05% in terms of accuracy, precision, detection rate, and F1-score, respectively. Furthermore, the evaluation results of the proposed method outperformed the state-of-the-art and showed that the proposed method is effective in detecting smishing messages.

Computer Malicious Code Signal Detection based on Big Data Technology

The article addresses the challenges modelled by the inadequacy of traditional detection methods in effectively handling the substantial volume of software behavior samples, particularly in big data. A novel approach is proposed for leveraging big data technology to detect malicious computer code signals. Additionally, it seeks to attack the issues associated with machine learning-based mobile malware detection, namely the presence of a large number of features, low accuracy in detection, and imbalanced data distribution. To resolve these challenges, this paper presents a multifaceted methodology. First, it introduces a feature selection technique based on mean and variance analysis to eliminate irrelevant features hindering classification accuracy. Next, a comprehensive classification method is implemented, utilizing various feature extraction techniques such as principal component analysis (PCA), Kaehunen-Loeve transform (KLT), and independent component analysis (ICA). These techniques collectively contribute to enhancing the Precision of the detection process. Recognizing the issue of unbalanced data distribution among software samples, the study proposes a multi-level classification integration model grounded in decision trees. In response, the research focuses on enhancing accuracy and mitigating the impact of data imbalance through a combination of feature selection, extraction techniques, and a multi-level classification model. The empirical results highlight the effectiveness of the proposed methodologies, showcasing notable accuracy improvements ranging from 3.36% to 6.41% across different detection methods on the Android platform. The introduced malware detection technology, grounded in source code analysis, demonstrates a promising capacity to identify Android malware effectively.

Android Malware Detection Approach Using Stacked AutoEncoder and Convolutional Neural Networks

In the past decade, Android has become a standard smartphone operating system. The mobile devices running on the Android operating system are particularly interesting to malware developers, as the users often keep personal information on their mobile devices. This paper proposes a deep learning model for mobile malware detection and classification. It is based on SAE for reducing the data dimensionality. Then, a CNN is utilized to detect and classify malware apps in Android devices through binary visualization. Tests were carried out with an original Android application (Drebin-215) dataset consisting of 15,036 applications. The conducted experiments prove that the classification performance achieves high accuracy of about 98.50%. Other performance measures used in the study are precision, recall, and F1-score. Finally, the accuracy and results of these techniques are analyzed by comparing the effectiveness with previous works.

An adaptive semi-supervised deep learning-based framework for the detection of Android malware

Positive developments in smartphone usage have led to an increase in malicious attacks, particularly targeting Android mobile devices. Android has been a primary target for malware exploiting security vulnerabilities due to the presence of critical applications, such as banking applications. Several machine learning-based models for mobile malware detection have been developed recently, but significant research is needed to achieve optimal efficiency and performance. The proliferation of Android devices and the increasing threat of mobile malware have made it imperative to develop effective methods for detecting malicious apps. This study proposes a robust hybrid deep learning-based approach for detecting and predicting Android malware that integrates Convolutional Neural Networks (CNN) and Long Short-Term Memory (LSTM). It also presents a creative machine learning-based strategy for dealing with unbalanced datasets, which can mislead the training algorithm during classification. The proposed strategy helps to improve method performance and mitigate over- and under-fitting concerns. The proposed model effectively detects Android malware. It extracts both temporal and spatial features from the dataset. A well-known Drebin dataset was used to train and evaluate the efficacy of all creative frameworks regarding the accuracy, sensitivity, MAE, RMSE, and AUC. The empirical finding proclaims the projected hybrid ConvLSTM model achieved remarkable performance with an accuracy of 0.99, a sensitivity of 0.99, and an AUC of 0.99. The proposed model outperforms standard machine learning-based algorithms in detecting malicious apps and provides a promising framework for real-time Android malware detection.

CRGB_Mem: At the intersection of memory forensics and machine learning

Mobile malware’s alarming sophistication and pervasiveness have continued to draw the attention of many cybersecurity researchers. Particularly on the Android platform, malware trojans designed to steal user PIIs, crypto miners, ransomware, and on-device fraud continue to infiltrate the primary Google store market and other secondary markets. While much effort has been put in place by the research community and industry to curb this menace since 2012, malware authors have consistently found ways to circumvent the existing detection and prevention mechanisms. Largely this remains so because of the restrictiveness of the feature set used in building the current classification models. Thus, the overarching objective of this paper is to bridge the gap between static and dynamic analysis by exploring the use of in-memory artifacts generated from the concrete execution of Android apps for effective malware classification. Our proposed approach, called RGB_Mem trains RGB images generated from in-memory allocation patterns in a Convolutional Neural Network. The result of our classification algorithm achieved an accuracy of 95.98% for samples with known objects and 84.48% for samples with unknown features. These results indicate that artifacts recovered from post-mortem memory forensics can provide a new dimension for training Android malware classification. The post-execution features, which are not impeded by any obfuscation and hooking constraints, provide a more accurate characterization of an app and are, therefore more suitable for classification.

MobiPCR: Efficient, accurate, and strict ML-based mobile malware detection

Mobile devices have been and will be continuously prevalent as rich applications are provided for various demands. However, the mobile operating system lacks efficient malware detection tools, which puts personal data at risk. This paper presents MobiPCR, a trict, accurate, efficient mobile-oriented malware detection system. MobiPCR basically integrates a (n) (edge) cloud-based architecture, a powerful yet efficient machine learning-based detection model, and a neat detection process. We implemented the MobiPCR prototype system and conducted rigorous experiments to evaluate its performance from different perspectives. We implemented the MobiPCR prototype system on the Android platform (Installer Hooker part) consiering considering that Android is an open-source platform that (i) can be easily modified and (ii) provides rich documentation. We used LineageOS 13 (a widespread Android distribution) to provide the necessary drivers to support communication and the camera for casual usage. Experimental results prove that MobiPCR can strictly and accurately detect malwares and outperform existing similar applications without extra operations.

A Survey and Evaluation of Android-Based Malware Evasion Techniques and Detection Frameworks

Android platform security is an active area of research where malware detection techniques continuously evolve to identify novel malware and improve the timely and accurate detection of existing malware. Adversaries are constantly in charge of employing innovative techniques to avoid or prolong malware detection effectively. Past studies have shown that malware detection systems are susceptible to evasion attacks where adversaries can successfully bypass the existing security defenses and deliver the malware to the target system without being detected. The evolution of escape-resistant systems is an open research problem. This paper presents a detailed taxonomy and evaluation of Android-based malware evasion techniques deployed to circumvent malware detection. The study characterizes such evasion techniques into two broad categories, polymorphism and metamorphism, and analyses techniques used for stealth malware detection based on the malware’s unique characteristics. Furthermore, the article also presents a qualitative and systematic comparison of evasion detection frameworks and their detection methodologies for Android-based malware. Finally, the survey discusses open-ended questions and potential future directions for continued research in mobile malware detection.