Search

In recent years, the scale and diversity of malicious software on mobile networks have grown significantly, thereby causing considerable danger to users' property and personal privacy. In this study, we propose a malware detection method that uses the URLs visited by apps to identify malware. A multi-view neural network is used to create a malware detection model that emphasizes depth and width. This neural network can create multiple views of inputs automatically and distribute soft attention weights to focus on different features of inputs. Multiple views preserve rich semantic information from inputs for classification without requiring complicated feature engineering. In addition, we conduct comprehensive experiments to compare the proposed method with others and verify the validity of the detection model. The experimental results show that our method achieves robust and timely malware detection. It can not only effectively detect malware discovered in different months of a certain year, but also detect potentially malicious apps in the third-party app market. We also compare the detection results of the proposed method on wild apps with 10 popular anti-virus scanners, and the final result shows that our approach ranks second in terms of detection performance. [ABSTRACT FROM AUTHOR]

Abstract In recent years, the number and variety of malicious mobile apps have increased drastically, especially on Android platform, which brings insurmountable challenges for malicious app detection. Researchers endeavor to discover the traces of malicious apps using network traffic analysis. In this study, we combine network traffic analysis with machine learning methods to identify malicious network behavior, and eventually to detect malicious apps. However, most network traffic generated by malicious apps is benign, while only a small portion of traffic is malicious, leading to an imbalanced data problem when the traffic model skews towards modeling the benign traffic. To address this problem, we introduce imbalanced classification methods, including the synthetic minority oversampling technique (SMOTE) + support vector machine (SVM), SVM cost-sensitive (SVMCS), and C4.5 cost-sensitive (C4.5CS) methods. However, when the imbalance rate reaches a certain threshold, the performance of common imbalanced classification algorithms degrades significantly. To avoid performance degradation, we propose to use the imbalanced data gravitation-based classification (IDGC) algorithm to classify imbalanced data. Moreover, we develop a simplex imbalanced data gravitation classification (S-IDGC) model to further reduce the time costs of IDGC without sacrificing the classification performance. In addition, we propose a machine learning based comparative benchmark prototype system, which provides users with substantial autonomy, such as multiple choices of the desired classifiers or traffic features. Using this prototype system, users can compare the detection performance of different classification algorithms on the same data set, as well as the performance of a specific classification algorithm on multiple data sets. [ABSTRACT FROM AUTHOR]

Abstract The existence of imbalanced classes can considerably degrade the performance of most standard learning algorithms. This paper presents a new imbalanced learning method called AWGSENN to address this problem on data level. In AWGSENN, each minority instance is firstly weighted based on the number of majority class neighbors and the distance of the minority instance to its neighbors. Then, a Gaussian distribution probability density function is designed to generate new instances nonlinearly. Finally, the edited nearest neighbor rule is used as a data cleaning technique to remove overlapping and noisy instances. The proposed method is evaluated in extensive experiments by comparing it with five over-sampling and two hybrid sampling methods on 37 data sets from the KEEL data repository. Empirical study results show that our approach can achieve significant performance improvement on G-mean and the area under curve metrics. Wilcoxon signed-rank test results show that our approach is superior to other resampling approaches. We apply the proposed method for Android malware detection, and the results further demonstrate the promising performance of our approach. [ABSTRACT FROM AUTHOR]