A Novel Deep Learning Based Attention Mechanism for Android Malware Detection and Explanation

With the popularity of Android mobile devices and the increase of related applications, hackers regard it as the primary attack target. Therefore, malware detection is essential nowadays, and many of these studies employ deep learning techniques. In recent years, the attention mechanism provides corresponding attention weights for different hidden states, and it is widely used in many fields, such as machine translation and image markup. However, no research has applied the attention mechanism to Android malware analysis. Hence, this paper completes the goal of malware family classification based on the static features of Android applications. We compare the difference between the original convolutional neural network (CNN) and the addition of the attention mechanism. The final experimental results show that the attention mechanism improves the accuracy of the existing CNN model by 1.99% in static opcode images. In addition, we further adopt the occlusion sensitivity method to try to explain the classification model proposed in this paper. Finally, the experimental results of model interpretation show that the classification model can effectively identify the threat behavior of malware.