Cyber Code Intelligence for Android Malware Detection.

Area of Science:

• Cybersecurity
• Machine Learning

Background:

• Android malware rapidly evolves, posing significant security risks to users.
• Existing machine learning (ML) methods struggle to detect zero-day malware families due to slow learning and limited feature representation.

Purpose of the Study:

• To develop a novel framework for detecting unknown and evolving Android malware by learning targeted capabilities.
• To address the limitations of current ML-based methods in handling the dynamic malware landscape.

Main Methods:

• Developed a multiview feature intelligence (MFI) framework.
• Extracted heterogeneous features via reverse engineering: semantic strings, API call graphs, and smali opcodes.
• Learned targeted capability representations from known malware families through feature analysis, selection, aggregation, and encoding.

Main Results:

• A new dataset with ground-truth capability information was created.
• Experiments demonstrated the MFI framework's effectiveness in detecting unknown Android malware with shared capabilities.
• The proposed method outperformed three state-of-the-art methods (Drebin, MaMaDroid, N-opcode).

Conclusions:

• The MFI framework offers a robust solution for identifying evolving Android malware by leveraging shared capabilities.
• This approach enhances the detection of zero-day threats and improves overall mobile security.
• Multiview feature learning is crucial for adapting to the dynamic nature of Android malware.