Affiliation:
1. School of Electrical Engineering and Computer Science, Washington State University, Pullman, WA
Abstract
Machine learning–based classification dominates current malware detection approaches for Android. However, due to the evolution of both the Android platform and its user apps, existing such techniques are widely limited by their reliance on new malware samples, which may not be timely available, and constant retraining, which is often very costly. As a result, new and emerging malware slips through, as seen from the continued surging of malware in the wild. Thus, a more practical detector needs not only to be accurate on particular datasets but, more critically, to be able to
sustain
its capabilities over time without frequent retraining. In this article, we propose and study the sustainability problem for learning-based app classifiers. We define sustainability metrics and compare them among five state-of-the-art malware detectors for Android. We further developed
DroidSpan
, a novel classification system based on a new behavioral profile for Android apps that captures sensitive access distribution from lightweight profiling. We evaluated the sustainability of
DroidSpan
versus the five detectors as baselines on longitudinal datasets across the past eight years, which include 13,627 benign apps and 12,755 malware. Through our extensive experiments, we showed that
DroidSpan
significantly outperformed all the baselines in substainability at reasonable costs, by 6%–32% for same-period detection and 21%–37% for over-time detection. The main
takeaway
, which also explains the superiority of
DroidSpan
, is that the use of features consistently differentiating malware from benign apps over time is essential for sustainable learning-based malware detection, and that these features can be learned from studies on app evolution.
Funder
National Science Foundation
Publisher
Association for Computing Machinery (ACM)
Reference65 articles.
1. Carly Page. 2015. Android malware accounts for 97% of all malicious mobile apps. Retrieved from: https://www.theinquirer.net/inquirer/news/2414949/android-accounts-for-97-percent-of-all-mobile-malware. Carly Page. 2015. Android malware accounts for 97% of all malicious mobile apps. Retrieved from: https://www.theinquirer.net/inquirer/news/2414949/android-accounts-for-97-percent-of-all-mobile-malware.
2. DroidAPIMiner: Mining API-Level Features for Robust Malware Detection in Android
3. Identifying Android malware using dynamically obtained features
4. AndroZoo
5. Adapting dynamic classifier selection for concept drift
Cited by
70 articles.
订阅此论文施引文献
订阅此论文施引文献,注册后可以免费订阅5篇论文的施引文献,订阅后可以查看论文全部施引文献