Dynamic analysis of Android malware makes it possible to run it in a secure virtual environment and observe the malicious behaviour it generates during operation. In the dynamic analysis of Android malware, techniques that circumvent static detection methods, such as code obfuscation and repackaging, become ineffective. Dynamic analysis typically represents software behavior through API sequences, which serve as the basis for determining whether software is malicious or not. However, most existing methods focus only on the API name or frequency of API and permission usage, neglecting key information such as the semantic context of APIs, which remains insufficient. In this paper, we propose a dynamic Android malware detection method based on quadruple sequence and a new data augmentation method, which includes a quadruple semantic chain for decomposing API to obtain semantic information and a new data augmentation method extracting additional software sequence information without disrupting user operations through dynamic analysis. Through quadruple decomposition, we get category, action, class and operation object of the API, so that we can fully mine the semantic information of the API and form a quadruple semantic chain. Through data augmentation, we improved the representation of API sequence information by concatenating identical software API sequences with the same window period. Our proposed model achieves an accuracy of 0.9163 and an F1-score of 0.9417 on a large dataset, which outperforms baselines significantly. We also performed ablation studies to demonstrate the effectiveness of our model.

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

DQSroid: Dynamic Android Malware Detection Based on Quadruple Sequences and Data Augmentation

  • Jinrong Kong,
  • Guojun Wang,
  • Mingfei Chen,
  • Yuheng Zhang,
  • Zhuoyi Wu,
  • Wanyi Gu

摘要

Dynamic analysis of Android malware makes it possible to run it in a secure virtual environment and observe the malicious behaviour it generates during operation. In the dynamic analysis of Android malware, techniques that circumvent static detection methods, such as code obfuscation and repackaging, become ineffective. Dynamic analysis typically represents software behavior through API sequences, which serve as the basis for determining whether software is malicious or not. However, most existing methods focus only on the API name or frequency of API and permission usage, neglecting key information such as the semantic context of APIs, which remains insufficient. In this paper, we propose a dynamic Android malware detection method based on quadruple sequence and a new data augmentation method, which includes a quadruple semantic chain for decomposing API to obtain semantic information and a new data augmentation method extracting additional software sequence information without disrupting user operations through dynamic analysis. Through quadruple decomposition, we get category, action, class and operation object of the API, so that we can fully mine the semantic information of the API and form a quadruple semantic chain. Through data augmentation, we improved the representation of API sequence information by concatenating identical software API sequences with the same window period. Our proposed model achieves an accuracy of 0.9163 and an F1-score of 0.9417 on a large dataset, which outperforms baselines significantly. We also performed ablation studies to demonstrate the effectiveness of our model.