[Paper Review] Droidetec: Android Malware Detection and Malicious Code Localization through Deep Learning

Zhuo Ma, Haoran Ge+3 more|arXiv (Cornell University)|Feb 10, 2020

Advanced Malware Detection Techniques36 references47 citations

TL;DR

Droidetec uses a Skip-Gram API embedding and Bi-LSTM with attention to detect Android malware from API sequences and localize malicious code by highlighting high-attention API fragments within methods.

ABSTRACT

Android malware detection is a critical step towards building a security credible system. Especially, manual search for the potential malicious code has plagued program analysts for a long time. In this paper, we propose Droidetec, a deep learning based method for android malware detection and malicious code localization, to model an application program as a natural language sequence. Droidetec adopts a novel feature extraction method to derive behavior sequences from Android applications. Based on that, the bi-directional Long Short Term Memory network is utilized for malware detection. Each unit in the extracted behavior sequence is inventively represented as a vector, which allows Droidetec to automatically analyze the semantics of sequence segments and eventually find out the malicious code. Experiments with 9616 malicious and 11982 benign programs show that Droidetec reaches an accuracy of 97.22% and an F1-score of 98.21%. In all, Droidetec has a hit rate of 91% to properly find out malicious code segments.

Motivation & Objective

• Motivate automatic, fine-grained Android malware detection beyond binary classification.
• Extract meaningful behavior sequences from DEX bytecode to model program execution as language-like sequences.
• Leverage attention mechanisms to identify and localize malicious code segments within apps.
• Enable robust detection that is resilient to obfuscation by focusing on API invocation patterns.

Proposed method

• Preprocess APKs to extract API invocation sequences from DEX files using invoke- instructions.
• Construct behavior sequences via depth-first invocation traversal starting at root methods.
• Represent APIs with distributed embeddings learned by Skip-Gram to produce API vectors.
• Train a Bi-LSTM with an attention layer on API vectors to classify apps as malware or benign.
• Use attention weights to compute a sequence representation and identify k-suspect APIs and methods for localization.

Experimental results

Research questions

• RQ1 Can API invocation sequences learned through embedding and Bi-LSTM with attention accurately detect Android malware?
• RQ2 Can the attention mechanism localize the likely malicious code segments within an app’s APIs and methods?
• RQ3 How does Droidetec perform across different malware families and against established scanners?
• RQ4 What is the impact of API vector dimensionality on detection accuracy and efficiency?

Key findings

• Droidetec achieves 97.22% accuracy and 98.21% F1-score with 2.11% FPR on the evaluated dataset.
• The method reaches around 91% hit rate for locating malicious code segments within apps.
• Droidetec outperforms Droid-Sec and Zhao et al. on detection metrics (Droidetec: 97.22% accuracy, 98.21% F1; Droid-Sec: 96.50% accuracy, 95.34% F1; Zhao: 91.92% accuracy, 90.50% F1).
• API vector dimension impacts: higher dimensions improve accuracy/recall but increase verification time, with 200-dimension vectors offering a favorable balance (97.2% accuracy, 98.2% F1).
• Attention distributions differ between benign and malware, and across families, enabling semantic differentiation of malicious behavior.