By the analysis of vulnerabilities of Android native system services,we find that some vulnerabilities are caused by inconsistent data transmission and inconsistent data processing logic between client and server.The ...By the analysis of vulnerabilities of Android native system services,we find that some vulnerabilities are caused by inconsistent data transmission and inconsistent data processing logic between client and server.The existing research cannot find the above two types of vulnerabilities and the test cases of them face the problem of low coverage.In this paper,we propose an extraction method of test cases based on the native system services of the client and design a case construction method that supports multi-parameter mutation based on genetic algorithm and priority strategy.Based on the above method,we implement a detection tool-BArcherFuzzer to detect vulnerabilities of Android native system services.The experiment results show that BArcherFuzzer found four vulnerabilities of hundreds of exception messages,all of them were confirmed by Google and one was assigned a Common Vulnerabilities and Exposures(CVE)number(CVE-2020-0363).展开更多
Due to its partly open-source architecture,which allows for application analysis and repackaging,along with its large market share,the Android operating system is a main target for malware.In recent years,researchers ...Due to its partly open-source architecture,which allows for application analysis and repackaging,along with its large market share,the Android operating system is a main target for malware.In recent years,researchers have widely adopted neural network-based methods for detecting Android malware,achieving impressive results but without interpretability.Interpretability is crucial for showing how models behave and identifying biases in their predictions,which helps in validating and improving them.Additionally,in urgent malware analysis situations,interpretability lets analysts quickly assess harmful behaviors and aids in future malware development and investigation.Therefore,interpretability is vital for ensuring that neural network-based malware detection models are trustworthy,predictable,and strong.To address these issues,we propose an interpretable Graph Attention Network(GAT)-based framework for Android malware detection.This framework includes data flow analysis of Android applications to identify malicious behaviors,providing clarity through the attention mechanism of GAT.Analysts and researchers can access detailed information,such as the names and execution order of the involved Android APIs,allowing for better validation and security checks.Experimental results show that our framework achieves a precision of 97.4%.Additionally,case studies highlight the insights that researchers can gain by using this framework.展开更多
Accurate malware identification and family categorization remain significant challenges in large-scale Android software analysis.Although deep learning has surpassed traditional machine learning in performance,its wid...Accurate malware identification and family categorization remain significant challenges in large-scale Android software analysis.Although deep learning has surpassed traditional machine learning in performance,its widespread adoption is hindered by the computational overhead stemming from feature redundancy and the lack of interpretability inherent in its black-box nature.To address these issues,this paper proposes DroidNTA,a DL-based detection model that fuses network traffic and API features.The model first constructs a simplified API Call Graph by extracting the intrinsic structural attributes of applications,and subsequently generates API feature vectors from invocation sequences using a Markov chain algorithm.These are then integrated with dynamic network traffic features to form a final representation vector of the Android instance.To enhance transparency,DroidNTA performs feature contribution analysis by adjusting fusion parameters and employs Shapley values to quantify global feature importance.Experimental results demonstrate that DroidNTA achieves superior performance in both binary and family classification tasks,yielding an accuracy of 99.74%and a gain of over 20%,respectively.We have released our code at http://gffzz188fe103f8f1460asfc5cb500w5cp6f60.ffgz.tsg.suse.edu.cn/joeyyk/DroidNTA.展开更多
Android smartphones have become an integral part of our daily lives,becoming targets for ransomware attacks.Such attacks encrypt user information and ask for payment to recover it.Conventional detection mechanisms,suc...Android smartphones have become an integral part of our daily lives,becoming targets for ransomware attacks.Such attacks encrypt user information and ask for payment to recover it.Conventional detection mechanisms,such as signature-based and heuristic techniques,often fail to detect new and polymorphic ransomware samples.To address this challenge,we employed various ensemble classifiers,such as Random Forest,Gradient Boosting,Bagging,and AutoML models.We aimed to showcase how AutoML can automate processes such as model selection,feature engineering,and hyperparameter optimization,to minimize manual effort while ensuring or enhancing performance compared to traditional approaches.We used this framework to test it with a publicly available dataset from the Kaggle repository,which contains features for Android ransomware network traffic.The dataset comprises 392,024 flow records,divided into eleven groups.There are ten classes for various ransomware types,including SVpeng,PornDroid,Koler,WannaLocker,and Lockerpin.There is also a class for regular traffic.We applied a three-step procedure to select themost relevant features:filter,wrapper,and embeddedmethods.The Bagging classifier was highly accurate,correctly getting 99.84%of the time.The FLAML AutoML framework was evenmore accurate,correctly getting 99.85%of the time.This is indicative of howwellAutoML performs in improving things with minimal human assistance.Our findings indicate that AutoML is an efficient,scalable,and flexible method to discover Android ransomware,and it will facilitate the development of next-generation intrusion detection systems.展开更多
Many machine learning-based Android malware detection often suffers from concept drift,where models trained on historical data fail to generalize to evolving threats.This paper proposes SCAN(Structural Clustering with...Many machine learning-based Android malware detection often suffers from concept drift,where models trained on historical data fail to generalize to evolving threats.This paper proposes SCAN(Structural Clustering with Adaptive thresholds for iNtelligent Android malware detection),a hybrid intelligent framework designed to mitigate concept drift without retraining.SCAN integrates Gaussian Mixture Models(GMMs)-based clustering with cluster-wise adaptive thresholding and supervised classifiers tailored to each cluster.A key challenge in clusteringbased malware detection is cluster-wise class imbalance,where clusters contain disproportionate distributions of benign and malicious samples.SCAN addresses this issue through adaptive thresholding,which dynamically adjusts the decision boundary of each cluster according to its malicious-to-benign ratio.In the final training stage,four supervised learning algorithms—Random Forest(RF),Support Vector Machine(SVM),k-NN,and XGBoost—are applied within the GMM-defined clusters.We train SCAN on Android applications collected from 2014-2017 and test it with applications from 2018-2023.Experimental results demonstrate that SCAN combined with RF consistently achieves superior performance,with both average accuracy and average F1-score exceeding 91%.These findings confirm SCAN’s robustness to concept drift and highlight its potential as a sustainable and intelligent solution for long-term Android malware detection in the real world.展开更多
Android ransomware has emerged as a major threat to mobile ecosystems.Modern Android ransomware has evolved beyond the reach of traditional signature-based detection,often lying dormant until specific strategic trigge...Android ransomware has emerged as a major threat to mobile ecosystems.Modern Android ransomware has evolved beyond the reach of traditional signature-based detection,often lying dormant until specific strategic triggers activate its malicious payload.These strategic ransomware variants activate payloads only under specific device states,events,and conditions that are absent in a sandbox testing environment.To address these sophisticated evasion tactics,this article introduces a novel framework,McIFAR(Multi-contextual Interaction-based Detection Framework for Android Ransomware),that leverages in-context emulation within malware sandboxing to elicit dormant behaviours that are missed by conventional testing,thereby transcending the limitations of isolated static or dynamic analysis.A robust two-stage methodology is presented.In the first stage,the Cross-Validation Feature Selection Ensemble(CVFSE)identifies dominant indicators.This is followed by the Contextual Interaction Feature Orchestrator(CIFO),processing dominant features to encode complex behavioral interactions between features and context in the second stage.Unlike existing studies that rely solely on static and dynamic data,this approach prioritizes contextual interaction,thereby significantly enhancing detection accuracy.The experimental results on the KronoDroid dataset demonstrate that McIFAR achieves a 99.48%detection accuracy,outperforming traditional baselines.The statistical analysis using the Friedman and Nemenyi post-hoc tests confirms that the results are both significant and consistent.The future work includes enhancing the framework by incorporating richer contextual scenarios in in-context emulation,along with federated learning and real-time lightweight deployment.展开更多
基金This work was supported by the National Key R&D Program of China(2023YFB3106800)the National Natural Science Foundation of China(Grant No.62072051).We are overwhelmed in all humbleness and gratefulness to acknowledge my depth to all those who have helped me to put these ideas.
摘要By the analysis of vulnerabilities of Android native system services,we find that some vulnerabilities are caused by inconsistent data transmission and inconsistent data processing logic between client and server.The existing research cannot find the above two types of vulnerabilities and the test cases of them face the problem of low coverage.In this paper,we propose an extraction method of test cases based on the native system services of the client and design a case construction method that supports multi-parameter mutation based on genetic algorithm and priority strategy.Based on the above method,we implement a detection tool-BArcherFuzzer to detect vulnerabilities of Android native system services.The experiment results show that BArcherFuzzer found four vulnerabilities of hundreds of exception messages,all of them were confirmed by Google and one was assigned a Common Vulnerabilities and Exposures(CVE)number(CVE-2020-0363).
基金in part by the Information Security Research Center at Taiwan Sun Yat-sen University,TaiwanThis work was also supported in part by the Ministry of Education,Science,Sports,and Culture,Grant-in-Aid for Scientific Research(C)22K12038Japan and in part by the Telecommunications Advancement Foundation(TAF)of Japan.
摘要Due to its partly open-source architecture,which allows for application analysis and repackaging,along with its large market share,the Android operating system is a main target for malware.In recent years,researchers have widely adopted neural network-based methods for detecting Android malware,achieving impressive results but without interpretability.Interpretability is crucial for showing how models behave and identifying biases in their predictions,which helps in validating and improving them.Additionally,in urgent malware analysis situations,interpretability lets analysts quickly assess harmful behaviors and aids in future malware development and investigation.Therefore,interpretability is vital for ensuring that neural network-based malware detection models are trustworthy,predictable,and strong.To address these issues,we propose an interpretable Graph Attention Network(GAT)-based framework for Android malware detection.This framework includes data flow analysis of Android applications to identify malicious behaviors,providing clarity through the attention mechanism of GAT.Analysts and researchers can access detailed information,such as the names and execution order of the involved Android APIs,allowing for better validation and security checks.Experimental results show that our framework achieves a precision of 97.4%.Additionally,case studies highlight the insights that researchers can gain by using this framework.
基金supported by the Shanghai Sailing Program 24YF2720000.
摘要Accurate malware identification and family categorization remain significant challenges in large-scale Android software analysis.Although deep learning has surpassed traditional machine learning in performance,its widespread adoption is hindered by the computational overhead stemming from feature redundancy and the lack of interpretability inherent in its black-box nature.To address these issues,this paper proposes DroidNTA,a DL-based detection model that fuses network traffic and API features.The model first constructs a simplified API Call Graph by extracting the intrinsic structural attributes of applications,and subsequently generates API feature vectors from invocation sequences using a Markov chain algorithm.These are then integrated with dynamic network traffic features to form a final representation vector of the Android instance.To enhance transparency,DroidNTA performs feature contribution analysis by adjusting fusion parameters and employs Shapley values to quantify global feature importance.Experimental results demonstrate that DroidNTA achieves superior performance in both binary and family classification tasks,yielding an accuracy of 99.74%and a gain of over 20%,respectively.We have released our code at http://gffzz188fe103f8f1460asfc5cb500w5cp6f60.ffgz.tsg.suse.edu.cn/joeyyk/DroidNTA.
基金supported through theOngoing Research Funding Program(ORF-2025-498),King Saud University,Riyadh,Saudi Arabia.
摘要Android smartphones have become an integral part of our daily lives,becoming targets for ransomware attacks.Such attacks encrypt user information and ask for payment to recover it.Conventional detection mechanisms,such as signature-based and heuristic techniques,often fail to detect new and polymorphic ransomware samples.To address this challenge,we employed various ensemble classifiers,such as Random Forest,Gradient Boosting,Bagging,and AutoML models.We aimed to showcase how AutoML can automate processes such as model selection,feature engineering,and hyperparameter optimization,to minimize manual effort while ensuring or enhancing performance compared to traditional approaches.We used this framework to test it with a publicly available dataset from the Kaggle repository,which contains features for Android ransomware network traffic.The dataset comprises 392,024 flow records,divided into eleven groups.There are ten classes for various ransomware types,including SVpeng,PornDroid,Koler,WannaLocker,and Lockerpin.There is also a class for regular traffic.We applied a three-step procedure to select themost relevant features:filter,wrapper,and embeddedmethods.The Bagging classifier was highly accurate,correctly getting 99.84%of the time.The FLAML AutoML framework was evenmore accurate,correctly getting 99.85%of the time.This is indicative of howwellAutoML performs in improving things with minimal human assistance.Our findings indicate that AutoML is an efficient,scalable,and flexible method to discover Android ransomware,and it will facilitate the development of next-generation intrusion detection systems.
基金supported in part by Basic Science Research Program through the National Research Foundation of Korea(NRF)funded by the Ministry of Science and ICT(No.2021R1A2C2012574)in part by the IITP(Institute of Information&Communications Technology Planning&Evaluation)-ITRC(Information Technology Research Center)grant funded by the Korea government(Ministry of Science and ICT)(IITP-2025-RS-2023-00259967).
摘要Many machine learning-based Android malware detection often suffers from concept drift,where models trained on historical data fail to generalize to evolving threats.This paper proposes SCAN(Structural Clustering with Adaptive thresholds for iNtelligent Android malware detection),a hybrid intelligent framework designed to mitigate concept drift without retraining.SCAN integrates Gaussian Mixture Models(GMMs)-based clustering with cluster-wise adaptive thresholding and supervised classifiers tailored to each cluster.A key challenge in clusteringbased malware detection is cluster-wise class imbalance,where clusters contain disproportionate distributions of benign and malicious samples.SCAN addresses this issue through adaptive thresholding,which dynamically adjusts the decision boundary of each cluster according to its malicious-to-benign ratio.In the final training stage,four supervised learning algorithms—Random Forest(RF),Support Vector Machine(SVM),k-NN,and XGBoost—are applied within the GMM-defined clusters.We train SCAN on Android applications collected from 2014-2017 and test it with applications from 2018-2023.Experimental results demonstrate that SCAN combined with RF consistently achieves superior performance,with both average accuracy and average F1-score exceeding 91%.These findings confirm SCAN’s robustness to concept drift and highlight its potential as a sustainable and intelligent solution for long-term Android malware detection in the real world.
基金funded by Princess Nourah bint Abdulrahman University Researchers Supporting Project number(PNURSP2026R701),Princess Nourah bint Abdulrahman University,Riyadh,Saudi Arabia.
摘要Android ransomware has emerged as a major threat to mobile ecosystems.Modern Android ransomware has evolved beyond the reach of traditional signature-based detection,often lying dormant until specific strategic triggers activate its malicious payload.These strategic ransomware variants activate payloads only under specific device states,events,and conditions that are absent in a sandbox testing environment.To address these sophisticated evasion tactics,this article introduces a novel framework,McIFAR(Multi-contextual Interaction-based Detection Framework for Android Ransomware),that leverages in-context emulation within malware sandboxing to elicit dormant behaviours that are missed by conventional testing,thereby transcending the limitations of isolated static or dynamic analysis.A robust two-stage methodology is presented.In the first stage,the Cross-Validation Feature Selection Ensemble(CVFSE)identifies dominant indicators.This is followed by the Contextual Interaction Feature Orchestrator(CIFO),processing dominant features to encode complex behavioral interactions between features and context in the second stage.Unlike existing studies that rely solely on static and dynamic data,this approach prioritizes contextual interaction,thereby significantly enhancing detection accuracy.The experimental results on the KronoDroid dataset demonstrate that McIFAR achieves a 99.48%detection accuracy,outperforming traditional baselines.The statistical analysis using the Friedman and Nemenyi post-hoc tests confirms that the results are both significant and consistent.The future work includes enhancing the framework by incorporating richer contextual scenarios in in-context emulation,along with federated learning and real-time lightweight deployment.