research-article

Android Malware Family Classification using Images from Dex Files

Authors:

Minkyu ParkAuthors Info & Claims

SMA 2020: The 9th International Conference on Smart Media and Applications

Pages 181 - 186

https://doi.org/10.1145/3426020.3426069

Published: 04 November 2021 Publication History

Get Access

Abstract

With the popularization 1 of the Android platform, Android malware occupies the largest portion of mobile malware. Malware family classification is important for fast and accurate detection. We propose a new detection method using images generated from Dex files of Android apps. We generate two kinds of images: one from an entire DEX file and one from a data section of a DEX file. We apply the CNN algorithm to the classification of both kinds of images. The experiments show that the proposed method classifies malware families with 91% accuracy for both cases. In the case of using only the data section, the performance of the ExploitLinuxLotoor family and Gappisin family were improved. Also, the deviation between Precision, Recall, and F1-Score was greatly reduced. The area under the Precision-Recall curve is almost the same in both experiments, which means that detection time can be shortened without deteriorating detection performance.

References

[1]

Daniel Arp, Michael Spreitzenbarth, Malte Hubner, Hugo Gascon, Konrad Rieck, and CERT Siemens. 2014. Drebin: Effective and explainable detection of android malware in your pocket. In Ndss, Vol. 14. 23–26.

Google Scholar

[2]

David Cournapeau. 2007. scikit-learn. Retrieved Sep 1, 2020 from https://scikit-learn.org/

Google Scholar

[3]

Daniel Gibert Llauradó. 2016. Convolutional neural networks for malware classification. Master’s thesis. Universitat Politècnica de Catalunya.

Google Scholar

[4]

TonTon Hsien-De Huang and Hung-Yu Kao. 2018. R2-d2: Color-inspired convolutional neural network (cnn)-based android malware detections. In 2018 IEEE International Conference on Big Data (Big Data). IEEE, 2633–2642.

Crossref

Google Scholar

[5]

Sakshi Indolia, Anil Kumar Goswami, SP Mishra, and Pooja Asopa. 2018. Conceptual understanding of convolutional neural network-a deep learning approach. Procedia computer science 132 (2018), 679–688.

Google Scholar

[6]

Jaemin Jung, Jongmoo Choi, Seong-je Cho, Sangchul Han, Minkyu Park, and Youngsup Hwang. 2018. Android malware detection using convolutional neural networks and data section images. In Proceedings of the 2018 Conference on Research in Adaptive and Convergent Systems. 149–153.

Digital Library

Google Scholar

[7]

Paul Sayak Nain, Aakash and Maynard-Reid Margaret. 2015. Keras. Retrieved Sep 1, 2020 from https://keras.io/

Google Scholar

[8]

Dong-Hyeok Park, Eui-Jung Myeong, and Joobeom Yun. 2016. Efficient Detection of Android Mutant Malwares Using the DEX file. Journal of the Korea Institute of Information Security & Cryptology 26, 4(2016), 895–902.

Crossref

Google Scholar

[9]

Edward Raff, Jon Barker, Jared Sylvester, Robert Brandon, Bryan Catanzaro, and Charles Nicholas. 2017. Malware detection by eating a whole exe. arXiv preprint arXiv:1710.09435(2017).

Google Scholar

[10]

R Samani. 2020. McAfee Mobile Threat Report Q1.

Google Scholar

[11]

Seonhee Seok and Howon Kim. 2016. Visualized malware classification based-on convolutional neural network. Journal of The Korea Institute of Information Security & Cryptology 26, 1(2016), 197–208.

Crossref

Google Scholar

[12]

Zhijie Tang, Peng Wang, and Junfeng Wang. 2020. ConvProtoNet: Deep prototype induction towards better class representation for few-shot malware classification. Applied Sciences 10, 8 (2020), 2847.

Crossref

Google Scholar

[13]

Rikiya Yamashita, Mizuho Nishio, Richard Kinh Gian Do, and Kaori Togashi. 2018. Convolutional neural networks: an overview and application in radiology. Insights into imaging 9, 4 (2018), 611–629.

Google Scholar

[14]

Yi-min YANG and Tie-ming CHEN. 2016. Android malware family classification method based on the image of bytecodeConstruction of MDS matrices. Chinese Journal of Netword and Information Security 2, 6 (2016), 38.

Google Scholar

Cited By

View all

Pham VCam NDuy PTan N(2025)RAX-ClaMal: Dynamic Android malware classification based on RAX register valuesInternet of Things10.1016/j.iot.2024.10148230(101482)Online publication date: Mar-2025
https://doi.org/10.1016/j.iot.2024.101482
Nguyen CKhoa NDoan KCam N(2023)Android Malware Category and Family Classification Using Static Analysis2023 International Conference on Information Networking (ICOIN)10.1109/ICOIN56518.2023.10049039(162-167)Online publication date: 11-Jan-2023
https://doi.org/10.1109/ICOIN56518.2023.10049039
Kim HKang MCho SChoi S(2022)Efficient Deep Learning Network With Multi-Streams for Android Malware Family ClassificationIEEE Access10.1109/ACCESS.2021.313933410(5518-5532)Online publication date: 2022
https://doi.org/10.1109/ACCESS.2021.3139334

Index Terms

Android Malware Family Classification using Images from Dex Files
1. Computing methodologies
  1. Machine learning
    1. Learning paradigms
      1. Supervised learning
2. Security and privacy
  1. Intrusion/anomaly detection and malware mitigation
  2. Systems security

Index terms have been assigned to the content through auto-classification.

Recommendations

Android Malware Detection via a Latent Network Behavior Analysis
TRUSTCOM '12: Proceedings of the 2012 IEEE 11th International Conference on Trust, Security and Privacy in Computing and Communications

The rapid growth of smartphones has lead to a renaissance for mobile application services. Android and iOS now as the most popular smartphone platforms offer a public marketplace respectively, the Android Market and App Store- but operate with ...
Hartley's test ranked opcodes for Android malware analysis
SIN '15: Proceedings of the 8th International Conference on Security of Information and Networks

The popularity and openness of Android platform encourage malware authors to penetrate various market places with malicious applications. As a result, malware detection has become a critical topic in security. Currently signature-based system is able to ...
Evaluating Machine Learning Models for Android Malware Detection: A Comparison Study
ICNCC '18: Proceedings of the 2018 VII International Conference on Network, Communication and Computing

Android is the most popular mobile operating system having billions of active users worldwide that attracted advertisers, hackers, and cybercriminals to develop malware for various purposes. In recent years, wide-ranging researches have been conducted ...

Comments

Information & Contributors

Information

Published In

SMA 2020: The 9th International Conference on Smart Media and Applications

September 2020

491 pages

ISBN:9781450389259

DOI:10.1145/3426020

Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for components of this work owned by others than ACM must be honored. Abstracting with credit is permitted. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. Request permissions from [email protected]

Publisher

Association for Computing Machinery

New York, NY, United States

Publication History

Published: 04 November 2021

Permissions

Request permissions for this article.

Request Permissions

Check for updates

Author Tags

Qualifiers

Research-article
Research
Refereed limited

Conference

SMA 2020

SMA 2020: The 9th International Conference on Smart Media and Applications

September 17 - 19, 2020

Jeju, Republic of Korea

Contributors

Other Metrics

View Article Metrics

Bibliometrics & Citations

Bibliometrics

Article Metrics

3
Total Citations
View Citations
119
Total Downloads

Downloads (Last 12 months)20
Downloads (Last 6 weeks)1

Reflects downloads up to 03 Mar 2025

Other Metrics

View Author Metrics

Citations

Cited By

View all

Pham VCam NDuy PTan N(2025)RAX-ClaMal: Dynamic Android malware classification based on RAX register valuesInternet of Things10.1016/j.iot.2024.10148230(101482)Online publication date: Mar-2025
https://doi.org/10.1016/j.iot.2024.101482
Nguyen CKhoa NDoan KCam N(2023)Android Malware Category and Family Classification Using Static Analysis2023 International Conference on Information Networking (ICOIN)10.1109/ICOIN56518.2023.10049039(162-167)Online publication date: 11-Jan-2023
https://doi.org/10.1109/ICOIN56518.2023.10049039
Kim HKang MCho SChoi S(2022)Efficient Deep Learning Network With Multi-Streams for Android Malware Family ClassificationIEEE Access10.1109/ACCESS.2021.313933410(5518-5532)Online publication date: 2022
https://doi.org/10.1109/ACCESS.2021.3139334

View Options

Login options

Check if you have access through your login credentials or your institution to get full access on this article.

Full Access

Get this Publication

View options

PDF

View or Download as a PDF file.

PDF

eReader

View online with eReader.

eReader

HTML Format

View this article in HTML Format.

HTML Format

Abstract

References

Cited By

Index Terms

Recommendations

Android Malware Detection via a Latent Network Behavior Analysis

Hartley's test ranked opcodes for Android malware analysis

Evaluating Machine Learning Models for Android Malware Detection: A Comparison Study

Comments

Information

Published In

Publisher

Publication History

Permissions

Check for updates

Author Tags

Qualifiers

Conference

Contributors

Other Metrics

Bibliometrics

Article Metrics

Other Metrics

Citations

Cited By

Login options

Full Access

View options

PDF

eReader

HTML Format

Share

Share this Publication link

Share on social media

Affiliations