Abstract:With the proliferation of Android malware, the demand for an effective and efficient malware detection system is on the rise. The existing device-end learning based solutions tend to extract limited syntax features (e.g., permissions and API calls) to meet a certain time constraint of mobile devices. However, syntax features lack the semantics which can represent the potential malicious behaviors and further result in more robust model with high accuracy for malware detection. In this paper, we propose an efficient Android malware detection system, named SeqMobile, which adopts behavior-based sequence features and leverages customized deep neural networks on mobile devices instead of the server. Different from the traditional sequence-based approaches on server, to meet the performance demand, SeqMobile accepts three effective performance optimization methods to reduce the time cost. To evaluate the effectiveness and efficiency of our system, we conduct experiments from the following aspects 1) the detection accuracy of different recurrent neural networks; 2) the feature extraction performance on different mobile devices, 3) the detection accuracy and prediction time cost of different sequence lengths. The results unveil that SeqMobile can effectively detect malware with high accuracy. Moreover, our performance optimization methods have proven to improve the performance of training and prediction by at least twofold. Additionally, to discover the potential performance optimization from the SOTA TensorFlow model optimization toolkit for our approach, we also provide an evaluation on the toolkit, which can serve as a guidance for other systems leveraging on sequence-based learning approach. Overall, we conclude that our sequence-based approach, together with our performance optimization methods, enable us to detect malware under the performance demands of mobile devices.

TCN-ATT: A Non-recurrent Model for Sequence-Based Malware Detection

Robust Neural Malware Detection Models for Emulation Sequence Learning

BiTCN-TAEfficientNet Malware Classification Approach Based on Sequence and RGB Fusion

Uncovering APT Malware Traffic Using Deep Learning Combined with Time Sequence and Association Analysis

Research on Malware Detection Technology for Mobile Terminals Based on API Call Sequence

SeqMobile: A Sequence Based Efficient Android Malware Detection System Using RNN on Mobile Devices

A Malicious Code Detection Method Based on Stacked Depthwise Separable Convolutions and Attention Mechanism

CNN-LSTM and Transfer Learning Models for Malware Classification based on Opcodes and API Calls

TS-Mal: Malware Detection Model Using Temporal and Structural Features Learnin

Detecting Malware with an Ensemble Method Based on Deep Neural Network

Task-Aware Meta Learning-based Siamese Neural Network for Classifying Obfuscated Malware

Mitigating the Impact of Malware Evolution on API Sequence-based Windows Malware Detector

Black-Box Attacks against RNN based Malware Detection Algorithms

A Hybrid Deep Learning Model for Malicious Behavior Detection

Towards Light-Weight Deep Learning Based Malware Detection

CBSeq: A Channel-Level Behavior Sequence for Encrypted Malware Traffic Detection

An Efficient DenseNet-Based Deep Learning Model for Malware Detection

Hybrid Deep Learning Approach Based on LSTM and CNN for Malware Detection

Using a Recurrent Neural Network and Restricted Boltzmann Machines for Malicious Traffic Detection

ConvDroid: Lightweight Neural Network Based Andoird Malware Detection.