4 ms·

It's less about the actual malware detection aspects and more about whether you can use an emulator to collect data from malicious apps. For background, those a

It's less about the actual malware detection aspects and more about whether you can use an emulator to collect data from malicious apps. For background, those apps tend to do the Volkswagen-trick where they detect their environment first and are only active on real Android devices. This white paper too finds that extracting the dynamic features (the data that would feed the ML algorithm) is more reliable on a device than on an emulator. Not surprising and not much to do with the machine learning aspects.

wolfos 9y ago
Hey, I'm from the same research group as the authors above. At the same conference, we also had a paper on Andorid malware detection using deep learning. (Our malware detection results are ok-ish, but we know how to make them much better, and will publish an updated paper soon). paper - http://dl.acm.org/citation.cfm?id=3029823 http://dl.acm.org/citation.cfm?id=3029823 code - https://github.com/niallmcl/Deep-Android-Malware-Detection https://github.com/niallmcl/Deep-Android-Malware-Detection
- wimagguc 9y ago
  What's a minimum sample size you've been successfully using? I'd imagine that finding APKs, disassembling them and finding the malware yourself for the training datasets are rather resource intensive tasks, so it's a difficult balancing act?
  - wolfos 9y ago
    We did an experiment where we vary the number of training samples and measure validation accuracy (Fig. 3). Basically, the system keeps getting better as you give it more data. (For good real world performance I'd say 10s of thousands of training samples would be needed). Initially, we were using an off the shelf dataset donated by an anti-virus company. Later we did some experiments using a much larger dataset collected by our colleagues at ASU. Although I was not involved with collecting that dataset, as far as I know the Android APKs were scraped from various online stores and checked for malware using virustotal.com

wolfos 9y ago

Hey, I'm from the same research group as the authors above. At the same conference, we also had a paper on Andorid malware detection using deep learning. (Our malware detection results are ok-ish, but we know how to make them much better, and will publish an updated paper soon). paper - http://dl.acm.org/citation.cfm?id=3029823 http://dl.acm.org/citation.cfm?id=3029823 code - https://github.com/niallmcl/Deep-Android-Malware-Detection https://github.com/niallmcl/Deep-Android-Malware-Detection

wimagguc 9y ago
What's a minimum sample size you've been successfully using? I'd imagine that finding APKs, disassembling them and finding the malware yourself for the training datasets are rather resource intensive tasks, so it's a difficult balancing act?
- wolfos 9y ago
  We did an experiment where we vary the number of training samples and measure validation accuracy (Fig. 3). Basically, the system keeps getting better as you give it more data. (For good real world performance I'd say 10s of thousands of training samples would be needed). Initially, we were using an off the shelf dataset donated by an anti-virus company. Later we did some experiments using a much larger dataset collected by our colleagues at ASU. Although I was not involved with collecting that dataset, as far as I know the Android APKs were scraped from various online stores and checked for malware using virustotal.com