DANdroid: A Multi-View Discriminative Adversarial Network for Obfuscated Android Malware Detection

Stuart Millar, Niall McLaughlin, Jesus Martinez del Rincon, Paul Miller, Ziming Zhao

Research output: Chapter in Book/Report/Conference proceedingConference contribution

4 Citations (Scopus)
104 Downloads (Pure)

Abstract

We present DANdroid, a novel Android malware detection model using a deep learning Discriminative Adversarial Network (DAN) that classifies both obfuscated and unobfuscated apps as either malicious or benign. Our method, which we empirically demonstrate is robust against a selection of four prevalent and real-world obfuscation techniques, makes three contributions. Firstly, an innovative application of discriminative adversarial learning results in malware feature representations with a strong degree of resilience to the four obfuscation techniques. Secondly, the use of three feature sets; raw opcodes, permissions and API calls, that are combined in a multi-view deep learning architecture to increase this obfuscation resilience. Thirdly, we demonstrate the potential of our model to generalize over rare and future obfuscation methods not seen in training. With an overall dataset of 68,880 obfuscated and unobfuscated malicious and benign samples, our multi-view DAN model achieves an average F-score of 0.973 that compares favourably with the state-of-the-art, despite being exposed to the selected obfuscation methods applied both individually and in combination.
Original languageEnglish
Title of host publicationProceeding of the 10th ACM Conference on Data and Application Security and Privacy
DOIs
Publication statusPublished - 01 Mar 2020
EventThe 10th ACM Conference on Data and Application Security and Privacy - New Orleans, United States
Duration: 16 Mar 202018 Mar 2020
Conference number: 10th
http://www.codaspy.org/2020/

Conference

ConferenceThe 10th ACM Conference on Data and Application Security and Privacy
Abbreviated titleCODASPY
CountryUnited States
CityNew Orleans
Period16/03/202018/03/2020
Internet address

Fingerprint Dive into the research topics of 'DANdroid: A Multi-View Discriminative Adversarial Network for Obfuscated Android Malware Detection'. Together they form a unique fingerprint.

Cite this