Abstract:With the popularity of Android growing exponentially, the amount of malware has significantly exploded. It is arguably one of the most viral problems on mobile platforms. Recently, various approaches have been introduced to detect Android malware, the majority of these are either based on the Manifest File features or the structural information, such as control flow graph and API calls. Among those methods, nearly all of them only consider the Java byte-code as the target to detect malicious behaviors. However, Recent research and our own statistics show that native payloads are commonly used in both benign and malicious apps. Current state-of-the-art Android static analysis tools avoid handling native method invocation. None of those tools have the capability to capture the inter-language behaviors. In this work, we explore an ensemble mechanism, which presents how the combination of byte-code and native-code analysis of Android applications can be efficiently used to cope with the advanced sophistication of Android malware. We, therefore, present a multi-layer approach that utilizes deep learning, natural language processing (NLP), as well as graph embedding techniques to handle the threats of Android malware, both from the Java byte-code and native code. After that, we design an ensemble algorithm to get the final result of malware detection system. To be specific, the first layer of our detection approach operates on the byte-code of application and the native code level, whereas the second layer focuses on the ensemble algorithm. Large-scale experiments on 100,113 samples (35,113 malware and 65,000 benign) show that only byte-code sub-system yields 99.8% accuracy and native-code sub-system yields an accuracy of 96.6%, whereas the Android-COCO method attains an accuracy of 99.86% which outperforms various related works.

Detecting Android Malware Using Bytecode Image

Android malware detection method based on bytecode image

Android Malware Detection Based on a Novel Mixed Bytecode Image Combined with Attention Mechanism

Opcode Sequence Analysis of Android Malware by a Convolutional Neural Network.

Android-COCO: Android Malware Detection with Graph Neural Network for Byte- and Native-Code

Learning-Based Detection for Malicious Android Application Using Code Vectorization

Deep Android Malware Detection

ImageDroid: Using Deep Learning to Efficiently Detect Android Malware and Automatically Mark Malicious Features

An Android Malware Detection Method Using Deep Learning Based on API Calls

R2-D2: ColoR-inspired Convolutional NeuRal Network (CNN)-based AndroiD Malware Detections

An Android Mutation Malware Detection Based on Deep Learning Using Visualization of Importance from Codes

Hybrid Sequence‐based Android Malware Detection Using Natural Language Processing

Deep Feature Extraction and Classification of Android Malware Images

Toward Mobile Malware Detection Through Convolutional Neural Networks

Image-Based Malware Classification Using QR and Aztec Codes

A Deep Feature Fusion Method for Android Malware Detection

Droidetec: Android Malware Detection and Malicious Code Localization through Deep Learning

Call Graph Based Android Malware Detection with CNN

Effective and Explainable Detection of Android Malware Based on Machine Learning Algorithms

OpCode-Level Function Call Graph Based Android Malware Classification Using Deep Learning