论文标题

掩盖:通过转移学习和模型个性化基于分析的恶意软件检测

Mask Off: Analytic-based Malware Detection By Transfer Learning and Model Personalization

论文作者

Pasdar, Amirmohammad, Lee, Young Choon, Hong, Seok-Hee

论文摘要

智能手机对网络攻击的脆弱性是用户的严重关注,这是由于已安装应用程序的完整性(\ textit {apps})引起的。尽管应用程序是为了提供合法和多元化的服务,但有害和危险的服务也揭示了可行的方法,使其穿透智能手机以实现恶意行为。彻底的应用分析是揭示恶意意图并提供更多有关安全风险评估的应用行为的关键。这种深入的分析激发了采用深层神经网络(DNN)从应用中提取的一系列特征和模式,以促进独立检测潜在危险的应用。本文介绍了基于分析的深神经网络Android恶意软件检测(ADAM),该网络采用一组精细的功能来训练特定于功能的DNN,在其地面真相未知时就应用标签达成共识。此外,亚当还利用转移学习技术来获得对跨智能手机的新应用的可调节性,以回收预训练的模型,并通过模型个性化和联合学习技术使其更适合适应。联邦学习后卫还可以协助这种可调节性,该警卫通过模型分析保护亚当免受中毒攻击。亚当依靠一个多样的数据集,其中包含153000多个应用程序,具有超过41000个用于DNNS培训的功能。平均而言,亚当的特定特定功能DNN的精度超过98%,导致针对数据操纵攻击的出色性能。

The vulnerability of smartphones to cyberattacks has been a severe concern to users arising from the integrity of installed applications (\textit{apps}). Although applications are to provide legitimate and diversified on-the-go services, harmful and dangerous ones have also uncovered the feasible way to penetrate smartphones for malicious behaviors. Thorough application analysis is key to revealing malicious intent and providing more insights into the application behavior for security risk assessments. Such in-depth analysis motivates employing deep neural networks (DNNs) for a set of features and patterns extracted from applications to facilitate detecting potentially dangerous applications independently. This paper presents an Analytic-based deep neural network, Android Malware detection (ADAM), that employs a fine-grained set of features to train feature-specific DNNs to have consensus on the application labels when their ground truth is unknown. In addition, ADAM leverages the transfer learning technique to obtain its adjustability to new applications across smartphones for recycling the pre-trained model(s) and making them more adaptable by model personalization and federated learning techniques. This adjustability is also assisted by federated learning guards, which protect ADAM against poisoning attacks through model analysis. ADAM relies on a diverse dataset containing more than 153000 applications with over 41000 extracted features for DNNs training. The ADAM's feature-specific DNNs, on average, achieved more than 98% accuracy, resulting in an outstanding performance against data manipulation attacks.

扫码加入交流群

加入微信交流群

微信交流群二维码

扫码加入学术交流群,获取更多资源