ADTDroid: Leveraging API description and TCP based active learning for Android malware detection

Context:

Extensive research has been conducted on neural network-based Android malware detection models to safeguard the Android software ecosystem. However, the efficacy of detection models may decline over time due to the continuous evolution of malicious behaviors, a phenomenon referred to as the model aging problem.

Objective:

To tackle this problem, existing researches primarily focus on API semantic feature learning and active learning. However, a major challenge in feature learning is the continuous updating of APIs. Additionally, the over-confidence problem in neural networks exacerbates the challenge of selecting uncertain samples during active learning. To handle these challenges, this paper proposes a novel android malware detection method called ADTDroid. It aims to enhance the performance of malware detection model against the ongoing API updating and malware evolution.

Method:

In this paper, we present a sensitive event graph based feature extraction approach that prioritizes suspicious APIs. To derive API embeddings for feature vector extraction, we propose learning these embeddings directly from API descriptions provided in official Android development documentation. This method facilitates the immediate acquisition of embeddings for updated APIs from the documentation. Furthermore, we propose a True Class Probability(TCP)-based confidence score to identify uncertain samples for model retraining. These samples exhibit genuine uncertainty, thereby enhancing the model’s adaptability to evolving data.

Results:

Through extensive experimentation on large-scale real-world datasets covering the period from 2013 to 2022, our method achieves significant improvements in the F-score of malware detection. Compared to existing active learning-based approaches, our method achieves relative improvements of approximately 10% over APIGraph and 8.1% over contrastive autoencoder techniques.

Conclusion:

ADTDroid can enhance the performance of feature extraction in cases of model aging. It can also improve the selection of uncertain samples to adapt the malware detection model to new data.