Experimental Study with Real-world Data for Android App Security Analysis using Machine Learning

By Sankardas Roy, J. DeLoach, Yuping Li, Nic Herndon, Doina Caragea, Xinming Ou, Venkatesh Prasad Ranganath, Hongmin Li, Nicolais Guevara. 2015

76 citations recorded by the source corpus.

Although Machine Learning (ML) based approaches have shown promise for Android malware detection, a set of critical challenges remain unaddressed. Some of those challenges arise in relation to proper evaluation of the detection approach while others are related to the design decisions of the same. In this paper, we systematically study the impact of these challenges as a set of research questions (i.e., hypotheses). We design an experimentation framework where we can reliably vary several parameters while evaluating ML-based Android malware detection approaches. The results from the experiments are then used to answer the research questions. Meanwhile, we also demonstrate the impact of some challenges on some existing ML-based approaches. The large (market-scale) dataset (benign and malicious apps) we use in the above experiments represents the real-world Android app security analysis scale. We envision this study to encourage the practice of employing a better evaluation strategy and better designs of future ML-based approaches for Android malware detection.

Subfields: Computer Networks and Communications, Software, Signal Processing

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Computer Networks and Communications

In Software

In Signal Processing

Citations in the corpus

Yes, Machine Learning Can Be More Secure! A Case Study on Android Malware Detection (2017, neutral): “This is consistent with the recent findings in [37], as it is shown that only”
Curie: A method for protecting SVM Classifier from Poisoning Attack (2016, unknown): “Machine learning techniques are widely used in areas such as biometric authentication [14], speaker identiﬁcation [12], malware detection in mobile platforms [17] etc.”
A Survey of App Store Analysis for Software Engineering (2017, unknown): “[191] and Khanmohammadi et al.”
Malware Detection in Adversarial Settings: Exploiting Feature Evolutions and Confusions in Android Apps (2017, background): “A recent study [35] shows that such large feature set has numerous non-informative or even misleading features.”
TESSERACT: Eliminating Experimental Bias in Malware Classification across Space and Time (2018, background): “[37] questioned the use of recent or older malware as training objects and the performance degradation in testing real-world object ratios.”
A Survey of Android Malware Detection with Deep Neural Models (2020, methodology): “Precision Recall Curve (PRC) and area under Precision Recall Curve (auPRC) outperformed ROC and AUC on a large and highly imbalanced dataset mimicking the real-world distribution of malware on the app store, according to Reference [47].”
FeatureSmith: Automatically Engineering Features for Malware Detection by Mining the Security Literature (2016, methodology): “We aim to engineer informative features for detecting malware in general, rather than malware from a speciﬁc data set, so we do not aim to outperform existing malware detection systems in terms of precision and re-call (feature selection methods would be better suited to this goal [13, 39]).”