This project has investigated how to apply big-data analysis techniques to analyze mobile apps for the Android platform for the purpose of accurately identifying security problems therein. A major challenge is the scale of the problem, with thousands of new apps entering the online app markets on a daily basis. Current technologies cannot keep up with the pace of the threats, and malware are regularly found in both large-scale marketplaces such as the official Google Play market and in third-party markets. The project has adopted advanced machine learning and deep learning techniques to tackle those challenges, as highlighted below.

We have studied machine learning algorithms on the task of detecting zero-day Android malware from noisy ground truth. We have performed extensive practical experimentation with different types of machine learning approaches, including traditional machine learning, transductive learning and modern recurrent neural networks. Experimental results have shown that all types of approaches can achieve verifiable zero-day malware detection, even when trained with a noisy ground truth dataset.

We have designed deep learning models based on a hybrid analysis technique, which combines the complementary strengths of the static and dynamic analysis paradigms to attain better accuracy. Using lightweight static and dynamic analysis procedures, we obtained multiple artifacts and used them to train deep learning models, specifically, long short-term memory (LSTM) networks, bidirectional LSTM  (BiLSTM) networks and attention based BiLSTM networks for identifying Android malware. Experimental results have shown that the best results are obtained with an attention-based BiLSTM model that uses hybrid static and dynamic artifacts. Furthermore, a robustness analysis has indicated that the best model is fairly robust against imbalanced data and is scalable. In another work, we have shown how the attention mechanism can be used to find the API calls that are predictive with respect to the maliciousness of Android apps. In turn, the information about predictive API calls can be used to improve the interpretability of the deep learning models.

We have designed a novel deep learning model based on capsule graph neural networks (CapsGNN). Our model makes use of more precise program semantics through an Android app's inter-procedural control flow graphs (ICFGs), instead of the code sequences found in the app's code. To perform a thorough comparison between our cutting-edge CapsGNN model and a traditional machine learning approach with features engineered in prior work, we created a market-scale dataset by collecting about 240K apps from 2017 to 2020 from a number of Android app stores through AndroZoo. This dataset reflects the distribution of malicious apps in the real world. We labeled the apps in the dataset following best practices from the literature, using the latest scan results from VirusTotal. We organized the evaluation data by quarters; models trained on one quarter are tested on the data in the following quarter. This ensures the evaluation results correspond to realistic use pattern of the models. Our experimental results showed that the deep learning and machine learning models generally have similar performances in terms of precision, recall, and F1 metrics, on our train/test subsets. The deep learning models, despite needing significantly more computational resources, do not appear to provide an obvious advantage over traditional machine learning when no changes occur in the Android development environment. However, the deep learning models perform better than the machine learning models when changes in the Android development environment are observed, likely due to the fact that deep learning has the ability to extract features on-the-fly and can thus handle changes in data distribution.

We will share with the research community the dataset (specifically, each app's SHA256 hash value as well as each app's VirusTotal report url based on which the app's label is determined). This dataset will enable other researchers to verify and reproduce our experimental results, as well as comparing with our results in further research in this area. Other outcomes of this project have been shared though public code repositories and disseminated as peer-reviewed conference or journal articles.

Components of this research have been integrated in courses taught by the PIs at their respective institutions. The research involved the training of two PhD students, six MS students and four undergraduate students, including one female PhD student, two female MS students, and two female undergraduate students. These students participated in dataset construction, data analysis and preprocessing, in the design and implementation of algorithms for Android malware identification, and in paper/thesis/report writing. Thus, all students have gained experience and skills in research, in collaboration, and in written and verbal technical communication.

Last Modified: 12/25/2021
Modified by: Xinming Ou