A novel preprocessing method for solving long sequence problem in android malware detection

Yi Ming Chen, Cheng Hao Hsu, Kuo Chung Kuo Chung

Research output: Chapter in Book/Report/Conference proceedingConference contributionpeer-review

2 Scopus citations

Abstract

Traditional machine learning mostly uses N-gram methods for serialization data prediction, which is not only time-consuming in the pre-processing but also computationally expensive for the model. For the current common malware detection methods, a variety of features such as API, system call, control flow, and permissions are used for machine learning analysis. However, these features depend on expert analysis and to extract multiple features is also time-consuming. This study uses Dalvik opcode as a feature, which is information rich and easy to extract. However, for the time series features of the opcode, the LSTM model and other sequence models will need effective dimension reduction approach because of the long sequence problem and variable feature length, resulting in poor training performance and long training time. Some study uses the training Embedding layer and Autoencoder to reduce the feature dimension. This method requires a layer of network training time. Another method is through feature selection. This method will result in different results as long as the data set changes or the sequence semantic is lost after feature selection. Therefore, in order to solve the above problems, this paper proposes a new preprocessing method to solve the long sequence problem that the LSTM model will encounter, so as to achieve fast training and high accuracy. This study uses a new pre-processing approach combined with an LSTM model to detect malware and achieve 95.58% accuracy on Drebin 10 family and only take 45 seconds to train a model. In addition, in the face of the small training sample problems common to deep learning, this research experiment also proved effective.

Original languageEnglish
Title of host publicationProceedings - 2019 12th International Conference on Ubi-Media Computing, Ubi-Media 2019
PublisherInstitute of Electrical and Electronics Engineers Inc.
Pages12-17
Number of pages6
ISBN (Electronic)9781728128207
DOIs
StatePublished - Aug 2019
Event12th International Conference on Ubi-Media Computing, Ubi-Media 2019 - Bali, Indonesia
Duration: 6 Aug 20199 Aug 2019

Publication series

NameProceedings - 2019 12th International Conference on Ubi-Media Computing, Ubi-Media 2019

Conference

Conference12th International Conference on Ubi-Media Computing, Ubi-Media 2019
Country/TerritoryIndonesia
CityBali
Period6/08/199/08/19

Keywords

  • Android malware detection
  • Dalvik opcode
  • LSTM
  • Preprocessing
  • Static analysis

Fingerprint

Dive into the research topics of 'A novel preprocessing method for solving long sequence problem in android malware detection'. Together they form a unique fingerprint.

Cite this