期刊
2019 IEEE/ACM 41ST INTERNATIONAL CONFERENCE ON SOFTWARE ENGINEERING (ICSE 2019)
卷 -, 期 -, 页码 771-782出版社
IEEE
DOI: 10.1109/ICSE.2019.00085
关键词
Android malware; graph embedding; familial analysis; unsupervised learning
类别
资金
- National Key R&D Program of China [2016YFB1000903]
- National Natural Science Foundation of China [61532004, 61532015, 61632015, 61602369, U1766215, 61772408, 61702414, 61833015]
- Innovative Research Group of the National Natural Science Foundation of China [61721002]
- Ministry of Education Innovation Research Team [IRT 17R86]
- consulting research project of Chinese academy of engineering The Online and Offline Mixed Educational Service System for 'The Belt and Road' Training in MOOC China
- RGC [PolyU 152279/16E, 152223/17E, CityU C100816G]
- Project of China Knowledge Centre for Engineering Science and Technology
The rapid growth of Android malware has posed severe security threats to smartphone users. On the basis of the familial trait of Android malware observed by previous work, the familial analysis is a promising way to help analysts better focus on the commonalities of malware samples within the same families, thus reducing the analytical workload and accelerating malware analysis. The majority of existing approaches rely on supervised learning and face three main challenges, i.e., low accuracy, low efficiency, and the lack of labeled dataset. To address these challenges, we first construct a fine-grained behavior model by abstracting the program semantics into a set of subgraphs. Then, we propose SRA, a novel feature that depicts the similarity relationships between the Structural Roles of sensitive API call nodes in subgraphs. An SRA is obtained based on graph embedding techniques and represented as a vector, thus we can effectively reduce the high complexity of graph matching. After that, instead of training a classifier with labeled samples, we construct malware link network based on SRAs and apply community detection algorithms on it to group the unlabeled samples into groups. We implement these ideas in a system called GefDroid that performs Graph embedding based familial analysis of AnDroid malware using unsupervised learning. Moreover, we conduct extensive experiments to evaluate GefDroid on three datasets with ground truth. The results show that GefDroid can achieve high agreements (0.707-0.883 in term of NMI) between the clustering results and the ground truth. Furthermore, GefDroid requires only linear run-time overhead and takes around 8.6s to analyze a sample on average, which is considerably faster than the previous work.
作者
我是这篇论文的作者
点击您的名字以认领此论文并将其添加到您的个人资料中。
推荐
暂无数据