Static malware detection and attribution in android byte-code through an end-to-end deep system

Highlights

• Deep learning based Android Malware detection System.

• Augmentation of Large-scale byte code dataset.

• End-to-End Feature learning.

• Static detection of Malware from byte code dataset.

Abstract

Android reflects a revolution in handhelds and mobile devices. It is a virtual machine based, an open source mobile platform that powers millions of smartphone and devices and even a larger no. of applications in its ecosystem. Surprisingly in a short lifespan, Android has also seen a colossal expansion in application malware with 99% of the total malware for smartphones being found in the Android ecosystem. Subsequently, quite a few techniques have been proposed in the literature for the analysis and detection of these malicious applications for the Android platform. The increasing and diversified nature of Android malware has immensely attenuated the usefulness of prevailing malware detectors, which leaves Android users susceptible to novel malware. Here in this paper, as a remedy to this problem, we propose an anti-malware system that uses customized learning models, which are sufficiently deep, and are ’End to End deep learning architectures which detect and attribute the Android malware via opcodes extracted from application bytecode’. Our results show that Bidirectional long short-term memory (BiLSTMs) neural networks can be used to detect static behavior of Android malware beating the state-of-the-art models without using handcrafted features. For our experiments in our system, we also choose to work with distinct and independent deep learning models leveraging sequence specialists like recurrent neural networks, Long Short Term Memory networks and its Bidirectional variation as well as those are more usual neural architectures like a network of all connected layers(fully connected), deep convnets, Diabolo network (autoencoders) and generative graphical models like deep belief networks for static malware analysis on Android. To test our system, we have also augmented a bytecode dataset from three open and independently maintained state-of-the-art datasets. Our bytecode dataset, which is on an order of magnitude large, essentially suffice for our experiments. Our results suggests that our proposed system can lead to better design of malware detectors as we report an accuracy of 0.999 and an F1-score of 0.996 on a large dataset of more than 1.8 million Android applications.

Introduction

Android represents a revolution in smartphones and mobile devices. It is an open source virtual machine based mobile platform powering countless smartphones, tablets, smart TVs, Car entertainment systems, and set top boxes etc. This means that developers have access to the source code, which can then be used to implement new features, add innovative attributes, and enhance the user experience.

Freelance developers also leverage Android to tinker and experiment with their ideas and offer a unique software platform often termed as ROM. Tech savvy users can then deploy such customized ROMs on their devices in case they are not satisfied with the user experience provided by the stock firmware installed on the device by its manufacturer. Lineage OS, Paranoid Android, and Resurrection remix are examples of such community driven ROMs. Therefore, while on other smartphone software you have the choice to choose from an array of applications (apps) available for the platform, Android is unique in a sense that in its ecosystem you can switch from stock firmware to custom ROMs, which are analogous to the choice you get in form of different Linux distributions. However, custom roms are not always a safe initiative to follow [1].

Another unique feature of Android platform is that applications are available from not only the native Google Play Store but also a variety of third party app sources. While apps downloaded and installed from the native app store can reasonably be trusted, the same cannot be said about the apps installed from third party sources [2], [3], [4].

However, the advent of malicious applications exploiting the ease of access provided for the above-mentioned software and hardware makes a nightmare situation for conventional malware detection systems to handle these malicious apps. Android has 3.5 million applications [5] in its ecology and 99% of the total malware is targeted towards Android [6].

On top of that, the native Google Play has 250 apps categorized as AntiVirus (AV), however 66% of the samples (170 apps) does not pass the AV criteria. These applications do not successfully distinguish malicious apps. They simply use whitelists and blacklists to sift through undesirable applications. The greater part of these applications are just a publicizing the PlayStore with a phony interface [7].

In the beginning, diagnoses of malware for Android was simple, since it showcased uncomplicated malicious attributes which could merely be named out by simply observing the tasks they performed. Eventually, malware for Android has progressively become unpredictable and have opted the more aggressive techniques. As an answer to this, researchers in malware security have proposed a variety of detection mechanisms. For a quick and brief summary Section 3 can be seen.

Problem: The customizability of Android through custom firmware and third party applications combined with the sensitivity of the information stored on these devices necessitates the development and implementation of cutting edge detection measures, to ensure the security of user and the device itself, and to apprehend the malware. This clearly depicts that the routine approaches for app defense are not sufficient to limit the ever-growing Android malware. Hence, the succeeding genesis of malware detection is highly desirable which can achieve the following objectives:

Objectives:

• Mirror the human effort of creating and extracting features via an automatic method and offload the burden to machines to learn progressively over time for correctly and efficiently carry out the feature engineering process.

• which is less prone to false alarms.

• the devised mechanism should support the large variety of development platforms.

Contribution: As a remedy in this paper, we resolve the dilemma of Android malware detection and attribution through a proposed anti-malware system of deep learning models which caters for the above mentioned objectives. Our devised system, which utilizes tailored variety of available models and essentially deal sequences such as recurrent neural networks (RNNs) [8] and its varied versions of Long short term memory (LSTM) [9] models and Bidirectional long short term memory (BiLSTM), others like deep autoencoders [10], deep belief networks (DBNs) [11] and those which have outperformed many vision benchmarks like fully connected neural networks [12], convolutional neural networks (CNNs) [13].

The details for design, customization and implementation of all these models, whereas the motivation backing the selection of these models and hyperparameters are given section wise. We show that our custom trained models can automatically engineer and learn features from an unlabeled and large input space (dataset) for malware detection similar to the tasks in category of vision and speech recognition [14], [15], [16]. This automatic and end-to-end feature engineering, classification [17] and malware attribution ability of these deep models equates for the human effort of manually analyzing the sample space and creating the features and static classification. Note that, analyzing malware without the need of executing is the essence of static analysis which is essentially helpful on low-power and memory-limited Android devices.

For our experiments, we also augment a large dataset of opcodes extracted from Android package kit(apks) and vectorize them through one-hot encoding. We aim to make this dataset freely available on demand. We also show that our system outperforms previous state-of-the-art.

Derived from our observations and experimentation through our deep learning system via BiLSTM achieves an accuracy of 0.99 and F1 score of 0.99, we conclude that our facts & figures prove the superiority of our tailored and trained versions of deep models over conventional machine learning methods in contemporary approaches towards mobile malware detection for Android. The rest of the paper is organized as followed:

Paper structure: In Section 2, rudimentary and essential details are provided, which accounts for malware analysis in the domain of Android (Section 2.1) and deep learning (Section 2.4). Section 3 describes the related work. Section 3 is then followed by the explanation of formal design and training of different deep learning architectures in the realm of malicious app. analysis for Android as Section 4. Our used tools are summarized in Section 5 as experimental setup. Computed results of our experimentation for all our models are given in Section 6. Finally, in Section 7 we provide the conclusion of our work.