{"type":"ScholarlyArticle","title":"Make Evasion Harder: An Intelligent Android Malware Detection System","authors":[{"name":"Shifu Hou","slug":"shifu-hou","given":"Shifu","family":"Hou","affiliation":"Department of CSEE , West Virginia Univerisity , WV , USA"},{"name":"Yanfang Ye","slug":"yanfang-ye","given":"Yanfang","family":"Ye","affiliation":"Department of CSEE , West Virginia Univerisity , WV , USA"},{"name":"Yangqiu Song","slug":"yangqiu-song","given":"Yangqiu","family":"Song","affiliation":"Department of CSE , Hong Kong University of Science and Technology , Hong Kong"},{"name":"Melih Abdulhayoglu","slug":"melih-abdulhayoglu","given":"Melih","family":"Abdulhayoglu","affiliation":"Comodo Security Solutions, Inc. , Clifton , NJ , USA"}],"abstract":"To combat the evolving Android malware attacks, in this paper, instead of only using Application Programming Interface (API) calls, we further analyze the different relationships between them and create higher-level semantics which require more efforts for attackers to evade the detection. We represent the Android applications (apps), related APIs, and their rich relationships as a structured heterogeneous information network (HIN). Then we use a meta-path based approach to characterize the semantic relatedness of apps and APIs. We use each meta-path to formulate a similarity measure over Android apps, and aggregate different similarities using multi-kernel learning to make predictions. Promising experimental results based on real sample collections from Comodo Cloud Security Center demonstrate that our developed system HinDroid outperforms other alternative Android malware detection techniques.","doi":"10.24963/ijcai.2018/737","url":"https://ijcai.org/proceedings/2018/737","pdf":"https://ijcai.org/proceedings/2018/0737.pdf","markdown":"https://ijcai.org/proceedings/2018/737.md","bibtex":"https://ijcai.org/proceedings/2018/bibtex/737","volume":{"slug":"2018","title":"Proceedings of the Twenty-Seventh International Joint Conference on Artificial Intelligence","short_title":"IJCAI 2018","url":"https://ijcai.org/proceedings/2018/","year":2018,"location":"Stockholm","dates":"13-19 July 2018","editors":"Jérôme Lang","isbn":"978-0-9992411-2-7","publisher":"International Joint Conferences on Artificial Intelligence Organization","doi_prefix":"10.24963/ijcai.2018"},"section":"Sister Conferences Best Papers","track":"Best Sister Conferences","number":737,"pages":{"first":5279,"last":5283},"keywords":["Machine Learning: Data Mining","Multidisciplinary Topics and Applications: Security and Privacy","Machine Learning: Machine Learning"],"videos":[],"references":[{"position":1,"raw":"[Burguera et al., 2011] Iker Burguera, Urko Zurutuza, and Simin Nadjm-Tehrani. Crowdroid: Behavior-based mal- ware detection system for android. In SPSM, 2011.","title":"Crowdroid: Behavior-based malware detection system for android","authors":"Iker Burguera, Urko Zurutuza, Simin Nadjm-Tehrani","year":"2011","venue":"SPSM","doi":null,"url":null,"internal_url":null},{"position":2,"raw":"[Chen et al., 2017a] Lingwei Chen, Shifu Hou, and Yanfang Ye. Securedroid: Enhancing security of machine learning- based detection against adversarial android malware at- tacks. In ACSAC, 2017.","title":"Securedroid: Enhancing security of machine learningbased detection against adversarial android malware attacks","authors":"Chen","year":"2017","venue":"ACSAC","doi":null,"url":null,"internal_url":null},{"position":3,"raw":"[Chen et al., 2017b] Lingwei Chen, Yanfang Ye, and Thiri- machos Bourlai. Adversarial machine learning in malware detection: Arms race between evasion attack and defense. In EISIC, 2017.","title":"Adversarial machine learning in malware detection: Arms race between evasion attack and defense","authors":"Chen","year":"2017","venue":"EISIC","doi":null,"url":null,"internal_url":null},{"position":4,"raw":"[Dimjasevic et al., 2016] Marko Dimjasevic, Simone Atzeni, Ivo Ugrina, and Zvonimir Rakamaric. Evaluation of android malware detection based on system calls. In IWSPA, 2016.","title":"Evaluation of android malware detection based on system calls","authors":"Marko Dimjasevic, Simone Atzeni, Ivo Ugrina, Zvonimir Rakamaric","year":"2016","venue":"IWSPA","doi":null,"url":null,"internal_url":null},{"position":5,"raw":"[Felt et al., 2011] Adrienne Porter Felt, Matthew Finifter, Erika Chin, Steve Hanna, and David Wagner. A survey of mobile malware in the wild. In SPSM, 2011.","title":"A survey of mobile malware in the wild","authors":"Adrienne Porter Felt, Matthew Finifter, Erika Chin, Steve Hanna, David Wagner","year":"2011","venue":"SPSM","doi":null,"url":null,"internal_url":null},{"position":6,"raw":"[Gönen and Alpaydin, 2011] Mehmet Gönen and Ethem Al- paydin. Multiple kernel learning algorithms. Journal of Machine Learning Research, 12:2211-2268, 2011.","title":"Multiple kernel learning algorithms","authors":"Mehmet Gönen, Ethem Alpaydin","year":"2011","venue":"Journal of Machine Learning Research","doi":null,"url":null,"internal_url":null},{"position":7,"raw":"[Hou et al., 2016a] Shifu Hou, Aaron Saas, Lifei Chen, and Yanfang Ye. Deep4maldroid: A deep learning framework for android malware detection based on linux kernel sys- tem call graphs. In WIW, pages 104-111, 2016.","title":"Deep4maldroid: A deep learning framework for android malware detection based on linux kernel system call graphs","authors":"Hou","year":"2016","venue":"WIW","doi":null,"url":null,"internal_url":null},{"position":8,"raw":"[Hou et al., 2016b] Shifu Hou, Aaron Saas, Yanfang Ye, and Lifei Chen. Droiddelver: An android malware detection system using deep belief network based on api call blocks. In WAIM, pages 54-66, 2016.","title":"Droiddelver: An android malware detection system using deep belief network based on api call blocks","authors":"Hou","year":"2016","venue":"WAIM","doi":null,"url":null,"internal_url":null},{"position":9,"raw":"[Hou et al., 2017] Shifu Hou, Yanfang Ye, Yangqiu Song, and Melih Abdulhayoglu. Hindroid: An intelligent an- droid malware detection system based on structured het- erogeneous information network. In SIGKDD, 2017.","title":"Hindroid: An intelligent android malware detection system based on structured heterogeneous information network","authors":"Hou","year":"2017","venue":"SIGKDD","doi":null,"url":null,"internal_url":null},{"position":10,"raw":"[IDC, 2017] IDC. Smartphone OS Market Share, 2017. https://www.idc.com/promo/smartphone-market-share/os.","title":"IDC. Smartphone OS Market Share","authors":null,"year":"2017","venue":null,"doi":null,"url":"https://www.idc.com/promo/smartphone-market-share/os","internal_url":null},{"position":11,"raw":"[Peiravian and Zhu, 2013] Naser Peiravian and Xingquan Zhu. Machine learning for android malware detection us- ing permission and api calls. In IEEE ICTAI, pages 300- 305, Nov 2013.","title":"Machine learning for android malware detection using permission and api calls","authors":"Zhu ; ] Peiravian, Xingquan Naser Peiravian, Zhu","year":"2013","venue":"IEEE ICTAI","doi":null,"url":null,"internal_url":null},{"position":12,"raw":"[Sun and Han, 2012] Yizhou Sun and Jiawei Han. Min- ing heterogeneous information networks: principles and methodologies. Synthesis Lectures on Data Mining and Knowledge Discovery, 3(2):1-159, 2012.","title":"Mining heterogeneous information networks: principles and methodologies","authors":"Han ; Sun, Yizhou Sun, Jiawei Han","year":"2012","venue":"Synthesis Lectures on Data Mining and Knowledge Discovery","doi":null,"url":null,"internal_url":null},{"position":13,"raw":"[Sun et al., 2011] Yizhou Sun, Jiawei Han, Xifeng Yan, Philip S. Yu, and Tianyi Wu. Pathsim: Meta path-based top-k similarity search in heterogeneous information net- works. PVLDB, pages 992-1003, 2011.","title":"Pathsim: Meta path-based top-k similarity search in heterogeneous information networks","authors":"Yizhou Sun, Jiawei Han, Xifeng Yan, Philip S Yu, Tianyi Wu","year":"2011","venue":"PVLDB","doi":null,"url":null,"internal_url":null},{"position":14,"raw":"[Tam et al., 2015] Kimberly Tam, Salahuddin J. Khan, Aris- tide Fattori, and Lorenzo Cavallaro. Copperdroid: Au- tomatic reconstruction of android malware behaviors. In NDSS, 2015.","title":"Copperdroid: Automatic reconstruction of android malware behaviors","authors":"Kimberly Tam, Salahuddin J Khan, Aristide Fattori, Lorenzo Cavallaro","year":"2015","venue":"NDSS","doi":null,"url":null,"internal_url":null},{"position":15,"raw":"[Vishwanathan et al., 2010] S. V. N. Vishwanathan, Zhaonan sun, Nawanol Ampornpunt, and Manik Varma. Multiple kernel learning and the SMO algorithm. In NIPS, pages 2361-2369, 2010.","title":"Multiple kernel learning and the SMO algorithm","authors":"S V N Vishwanathan, Nawanol Zhaonan Sun, Manik Ampornpunt, Varma","year":"2010","venue":"NIPS","doi":null,"url":null,"internal_url":null},{"position":16,"raw":"[Wang et al., 2015] Chenguang Wang, Yangqiu Song, Hao- ran Li, Ming Zhang, and Jiawei Han. Knowsim: A doc- ument similarity measure on structured heterogeneous in- formation networks. In ICDM, pages 1015-1020, 2015.","title":"Knowsim: A document similarity measure on structured heterogeneous information networks","authors":"Chenguang Wang, Yangqiu Song, Haoran Li, Ming Zhang, Jiawei Han","year":"2015","venue":"ICDM","doi":null,"url":null,"internal_url":null},{"position":17,"raw":"[Wood, 2015] P. Wood. Internet security threat report 2015. In Symantec, 2015.","title":"Internet security threat report 2015","authors":"P Wood","year":"2015","venue":null,"doi":null,"url":null,"internal_url":null},{"position":18,"raw":"[Wu and Hung, 2014] Wen-Chieh Wu and Shih-Hao Hung. Droiddolphin: A dynamic android malware detection framework using big data and machine learning. In RACS, 2014.","title":"Droiddolphin: A dynamic android malware detection framework using big data and machine learning","authors":"Wen-Chieh Wu, Shih-Hao Hung","year":"2014","venue":"RACS","doi":null,"url":null,"internal_url":null},{"position":19,"raw":"[Wu et al., 2012] Dong-Jie Wu, Ching-Hao Mao, Te-En Wei, Hahn-Ming Lee, and Kuo-Ping Wu. Droidmat: Android malware detection through manifest and api calls tracing. In Asia JCIS, pages 62-69, Aug 2012.","title":"Droidmat: Android malware detection through manifest and api calls tracing","authors":"Dong-Jie Wu, Ching-Hao Mao, Te-En Wei, Hahn-Ming Lee, Kuo-Ping Wu","year":"2012","venue":"Asia JCIS","doi":null,"url":null,"internal_url":null},{"position":20,"raw":"[Yang et al., 2014] Chao Yang, Zhaoyan Xu, Guofei Gu, Vinod Yegneswaran, and Phillip Porras. Droidminer: Au- tomated mining and characterization of fine-grained mali- cious behaviors in android applications. In 19th European Symposium on Research in Computer Security, pages 163- 182, 2014.","title":"Droidminer: Automated mining and characterization of fine-grained malicious behaviors in android applications","authors":"Chao Yang, Zhaoyan Xu, Guofei Gu, Vinod Yegneswaran, Phillip Porras","year":"2014","venue":"19th European Symposium on Research in Computer Security","doi":null,"url":null,"internal_url":null},{"position":21,"raw":"[Ye et al., 2011] Yanfang Ye, Tao Li, Shenghuo Zhu, Wei- wei Zhuang, Egemen Tas, Umesh Gupta, and Melih Ab- dulhayoglu. Combining file content and file relations for cloud based malware detection. In SIGKDD, pages 222- 230, 2011.","title":"Combining file content and file relations for cloud based malware detection","authors":"Ye","year":"2011","venue":"SIGKDD","doi":null,"url":null,"internal_url":null},{"position":22,"raw":"[Ye et al., 2017a] Yanfang Ye, Lingwei Chen, Shifu Hou, William Hardy, and Xin Li. Deepam: A heterogeneous deep learning framework for intelligent malware detection. Knowledge and Information Systems, pages 1-21, 2017.","title":"Deepam: A heterogeneous deep learning framework for intelligent malware detection","authors":"Ye","year":"2017","venue":"Knowledge and Information Systems","doi":null,"url":null,"internal_url":null},{"position":23,"raw":"[Ye et al., 2017b] Yanfang Ye, Tao Li, Donald Adjeroh, and S Sitharama Iyengar. A survey on malware detection us- ing data mining techniques. ACM Computing Surveys, 50(3):41, 2017.","title":"A survey on malware detection using data mining techniques","authors":"Ye","year":"2017","venue":"ACM Computing Surveys","doi":null,"url":null,"internal_url":null}],"license_note":"Copyright International Joint Conferences on Artificial Intelligence."}