[Paper Review] Stimulation and Detection of Android Repackaged Malware with Active Learning

Aleieldin Salem|arXiv (Cornell University)|Aug 3, 2018

Advanced Malware Detection Techniques28 references4 citations

TL;DR

This paper proposes Aion, an active learning framework that iteratively stimulates and refines behavioral representations of Android repackaged malware to improve detection accuracy. By enabling classifiers to request more informative runtime executions, Aion achieves a test F1 score of 72% on the Piggybacking dataset, outperforming conventional methods in detecting malicious payloads hidden within benign apps.

ABSTRACT

Repackaging is a technique that has been increasingly adopted by authors of Android malware. The main problem facing the research community working on devising techniques to detect this breed of malware is the lack of ground truth that pinpoints the malicious segments grafted within benign apps. Without this crucial knowledge, it is difficult to train reliable classifiers able to effectively classify novel, out-of-sample repackaged malware. To circumvent this problem, we argue that reliable classifiers can be trained to detect repackaged malware, if they are allowed to request new, more accurate representations of an app's behavior. This learning technique is referred to as active learning. In this paper, we propose the usage of active learning to train classifiers able to cope with the ambiguous nature of repackaged malware. We implemented an architecture, Aion, that connects the processes of stimulating and detecting repackaged malware using a feedback loop depicting active learning. Our evaluation of a sample implementation of Aion using two malware datasets (Malgenome and Piggybacking) shows that active learning can outperform conventional detection techniques and, hence, has great potential to detect Android repackaged malware.

Motivation & Objective

• To address the lack of ground truth in repackaged malware detection, where malicious code segments are not clearly identified in training data.
• To improve classifier performance by enabling dynamic, feedback-driven exploration of app behaviors during training.
• To develop a system that can effectively stimulate and detect repackaged malware despite the absence of precise labels for malicious code locations.
• To evaluate whether active learning can outperform static or conventional dynamic detection methods in identifying repackaged malware.
• To establish a foundation for future detection techniques focused on the semantic and behavioral nuances of repackaged Android malware.

Proposed method

• The Aion architecture implements a feedback loop where misclassified apps trigger re-execution with new stimulation strategies to discover more representative behavioral features.
• Active learning is applied during training: when a classifier misclassifies an app, it requests new execution paths to improve feature representation.
• Feature vectors from multiple executions are aggregated (e.g., via majority voting) to form a more accurate behavioral profile of each app.
• The system uses dynamic analysis to extract behavioral signatures (e.g., API call traces) from different execution paths, especially those likely to trigger hidden malicious payloads.
• A training loop continues until maximum classification accuracy is achieved, indicating comprehensive behavioral coverage of the app.
• The approach is evaluated on two datasets—Malgenome and Piggybacking—using standard machine learning classifiers trained on dynamically refined feature sets.

Experimental results

Research questions

• RQ1 Can active learning improve the detection of repackaged Android malware by refining behavioral representations through iterative stimulation?
• RQ2 How does the performance of active learning compare to conventional static or dynamic detection methods in identifying malicious payloads in repackaged apps?
• RQ3 To what extent does the number of execution iterations correlate with the ability to detect hidden malicious behavior in repackaged malware?
• RQ4 Can feedback-driven exploration of execution paths lead to better generalization and higher F1 scores on out-of-sample test apps?
• RQ5 Does the absence of ground truth for malicious code locations significantly hinder detection, and can active learning mitigate this limitation?

Key findings

• The active learning-based classifier achieved a test F1 score of 72% on the Piggybacking dataset, demonstrating improved detection capability over conventional methods.
• The framework successfully mitigates the challenge of missing ground truth by iteratively refining behavioral representations through feedback-driven execution.
• The number of execution iterations required to achieve high accuracy correlates with the complexity of detecting hidden malicious payloads, suggesting a link between stimulation depth and detection efficacy.
• Active learning outperformed traditional detection techniques by dynamically adapting to the ambiguous and obfuscated nature of repackaged malware.
• The evaluation confirms that iterative stimulation leads to better feature representation, enabling more accurate classification of apps with stealthy, injected malicious behavior.
• The results indicate that active learning is a viable and effective approach for detecting repackaged malware, especially in the absence of precise labels for malicious code segments.