ViTDroid: Vision Transformers for Efficient, Explainable Attention to Malicious Behavior in Android Binaries

Area of Science:

• Computer Science
• Cybersecurity
• Artificial Intelligence

Background:

• Android dominates the mobile OS market (71% share), making its users vulnerable to increasing mobile malware threats.
• Traditional malware analysis struggles to keep pace with the growing volume and sophistication of mobile malware.
• Deep learning models, while effective in image analysis, face challenges in explaining malware characteristics and have limitations like translation invariance in CNNs.

Purpose of the Study:

• To introduce ViTDroid, a novel deep learning model utilizing vision transformers for analyzing Android malware opcode sequences.
• To enhance the explainability of deep learning models in malware analysis, moving beyond mere classification.
• To provide actionable insights into the specific instructions causing malicious behavior in Android malware samples.

Main Methods:

• Developed ViTDroid, a vision transformer-based deep learning model for analyzing opcode sequences of Android malware.
• Trained and evaluated the model on large, real-world datasets of Android malware samples.
• Focused on achieving explainable predictions by identifying malicious behavior-causing instructions.

Main Results:

• Achieved a low false positive rate of 0.0019, surpassing the previous best of 0.0021.
• Demonstrated the model's capability to not only classify malware accurately but also pinpoint specific malicious instructions.
• Provided explainable insights into the reasons behind malware classification.

Conclusions:

• ViTDroid offers a significant advancement in deep learning-based Android malware analysis through explainable predictions.
• The model's ability to identify malicious instructions aids human experts, enhancing the overall malware analysis process.
• ViTDroid contributes to improving cybersecurity by offering deeper insights into malware behavior and facilitating more effective threat detection.