Abstract:Android is a growing target for malicious software (malware) because of its popularity and functionality. Malware poses a serious threat to users' privacy, money, equipment and file integrity. A series of data-driven malware detection methods were proposed. However, there exist two key challenges for these methods: (1) how to learn effective feature representation from raw data; (2) how to reduce the dependence on the prior knowledge or human labors in feature learning. Inspired by the success of deep learning methods in the feature representation learning community, we propose a malware detection framework which starts with learning rich-features by a novel unsupervised feature learning algorithm Merged Sparse Auto-Encoder (MSAE). In order to extract more compact and discriminative feature from the rich-features to further boost the malware detection capability, a hybrid deep network learning algorithm Stacked Hybrid Learning MSAE and SDAE (SHLMD) is established by further incorporating a classical deep learning method Stacked Denoising Auto-encoders (SDAE). After that, we feed the feature learned by MSAE and SHLMD respectively to classification algorithms, e.g., Support Vector Machine (SVM) or K-NearestNeighbor (KNN), to train a malware detection model. Evaluation results on two real-world datasets demonstrate that SHLMD achieves 94.46 and 90.57 percent accuracy respectively, which outperforms the classical unsupervised feature representation learning Sparse Auto-encoder (SAE). MSAE performs similarly to SAE. SHLMD can further improve the performance of MSAE and the supervised fine-tuned method SDAE. Besides, we compare the performance of our methods with that of state-of-the-art detection approaches, including classical deep-learning-based methods. Extensive experiments show that our proposed methods are effective enough to detect Android malware.

SDAC: A Slow-Aging Solution for Android Malware Detection Using Semantic Distance Based API Clustering

Enhancing State-of-the-art Classifiers with API Semantics to Detect Evolved Android Malware

Slowing Down the Aging of Learning-Based Malware Detectors with API Knowledge

An Efficient Android Malware Detection System Based on Method-Level Behavioral Semantic Analysis.

MDADroid

AndroCreme - Unseen Android Malware Detection Based on Inductive Conformal Learning.

A Hybrid Deep Network Framework for Android Malware Detection

Context-aware, Adaptive and Scalable Android Malware Detection through Online Learning (extended version)

An Android Malware Detection Method Using Deep Learning Based on API Calls

Adaptive and Scalable Android Malware Detection through Online Learning

Efficient Concept Drift Handling for Batch Android Malware Detection Models

Mdadroid: A Novel Malware Detection Method by Constructing Functionality-Api Mapping

Dynamic Malware Analysis Based on API Sequence Semantic Fusion

AiDroid: When Heterogeneous Information Network Marries Deep Neural Network for Real-time Android Malware Detection

Mitigating the Impact of Malware Evolution on API Sequence-based Windows Malware Detector

A method of multidimensional software aging prediction based on ensemble learning: A case of Android OS

MaMaDroid: Detecting Android Malware by Building Markov Chains of Behavioral Models (Extended Version)

MAPAS: a practical deep learning-based android malware detection system

EAODroid: Android Malware Detection Based on Enhanced API Order

Strengthening LLM ecosystem security: Preventing mobile malware from manipulating LLM-based applications

Efficient malware detection through inter-component communication analysis