A malware detection system using a hybrid approach of multi-heads attention-based control flow traces and image...

Area of Science:

• Computer Science
• Cybersecurity
• Machine Learning

Background:

• Android's widespread use makes it a target for malware.
• Existing machine learning malware detection methods face challenges from adversarial feature manipulation.
• Novel feature engineering is crucial for robust Android security.

Purpose of the Study:

• To propose a novel feature representation for enhanced Android malware detection.
• To combine API-Call Graphs (ACGs) with byte-level image representation for improved accuracy.
• To develop a robust defense against sophisticated malware evasion techniques.

Main Methods:

• Reverse engineering of Android Package Kits (APKs) to extract Java code and Dalvik Executable (DEX) files.
• Generation of ACGs from Control Flow Graphs (CFGs) to represent app behavior.
• Application of multi-head attention-based transfer learning on ACGs and texture feature extraction from DEX file images using FAST and BRIEF algorithms.

Main Results:

• A hybrid feature representation combining ACGs and image texture features was developed.
• The proposed method achieved a high accuracy of 99.27% on a customized dataset.
• Performance surpassed existing state-of-the-art malware detection techniques.

Conclusions:

• The combined approach of ACGs and image texture features offers a powerful method for Android malware detection.
• This novel technique enhances the ability to identify suspicious activities and classify malware effectively.
• The findings contribute to advancing the field of mobile security against evolving threats.