MalDuoNet: A DualNet Framework to Detect Android Malware

Abstract

Today mobile phones provide a wide range of applications that make our daily life easy. With popularity, smartphones have become a target for cybercrime where malicious apps are developed to acquire sensitive information or corrupt data. To mitigate this issue and to improve the security in mobile devices, different techniques have been used. These techniques can be broadly classified as static, dynamic and hybrid approaches. In this paper, a static-based model MalDuoNet is proposed to detect Android malwares, which uses a DualNet framework to analyze the features from the API calls. In the MalDuoNet model, one sub-network is focused to learn the features relevant to malicious behavior and the other sub-network is focused to learn the features in general. Thus it enables the model to learn complementary features which in turn helps get richer features for analysis. Then the features from the two sub-networks are combined in the final fused classifier for the final classification. In addition, each of the feature extractors has a separate classifier so that each sub-network can optimize its performance separately. The experimental results demonstrate that the MalDuoNet model outperforms the two baseline models with single network.