SeqMobile: A Sequence Based Efficient Android Malware Detection System Using RNN on Mobile Devices

summary

Video file (mp4)

The gist

The gist The proposed SeqMobile system is an efficient sequence-based malware detection system that uses behavior-based sequence features and customized deep neural networks on mobile devices to

In short

SeqMobile is an efficient system to detect Android malware using behavior-based sequence features instead of simple syntax features like permissions. It uses customized deep neural networks directly on mobile devices. By employing three performance optimization methods, the system achieves high detection accuracy (97.85%) while maintaining reasonable prediction times, proving that sequence learning can meet mobile device performance demands.

Key concepts

Behavior-based Sequence Features
Instead of just looking at a list of permissions or API calls (syntax), this method analyzes the order and flow of actions an app takes. This sequence information captures the potential malicious behavior, giving the detection system deeper meaning about what an application is doing, which helps distinguish malware from safe apps.
Customized Bi-LSTM Network
The system uses a Bidirectional Long Short-Term Memory (Bi-LSTM) network as its core classifier. This network reads the input sequence in both forward and backward directions simultaneously, allowing it to capture complex contextual information from the entire sequence, leading to higher detection accuracy compared to simpler neural networks.
Performance Optimization Methods
To ensure fast operation on mobile phones, SeqMobile uses several tricks. These include using native code for feature extraction and a repetitive element removal technique. These methods reduce the input size and processing time without significantly hurting the system's ability to accurately identify malware.
Dynamic Prediction Time
The model is designed to have prediction times that change based on how long the extracted sequence is. This dynamic approach allows for better performance management, as it can be optimized for different sequence lengths, leading to faster results when necessary.

Terminology used across episodes

This episode discusses

The paper

SeqMobile: A Sequence Based Efficient Android Malware Detection System Using RNN on Mobile Devices · Read on arXiv

School of Computer Science and Engineering, Nanyang Technological University · College of Intelligence and Computing, Tianjin University

With the proliferation of Android malware, the demand for an effective and efficient malware detection system is on the rise. The existing device-end learning based solutions tend to extract limited syntax features (e.g., permissions and API calls) to meet a certain time constraint of mobile devices. However, syntax features lack the semantics which can represent the potential malicious behaviors and further result in more robust model with high accuracy for malware detection. In this paper, we propose an efficient Android malware detection system, named SeqMobile, which adopts behavior-based sequence features and leverages customized deep neural networks on mobile devices instead of the server. Different from the traditional sequence-based approaches on server, to meet the performance demand, SeqMobile accepts three effective performance optimization methods to reduce the time cost. To evaluate the effectiveness and efficiency of our system, we conduct experiments from the following aspects 1) the detection accuracy of different recurrent neural networks; 2) the feature extraction performance on different mobile devices, 3) the detection accuracy and prediction time cost of different sequence lengths. The results unveil that SeqMobile can effectively detect malware with high accuracy. Moreover, our performance optimization methods have proven to improve the performance of training and prediction by at least twofold. Additionally, to discover the potential performance optimization from the SOTA TensorFlow model optimization toolkit for our approach, we also provide an evaluation on the toolkit, which can serve as a guidance for other systems leveraging on sequence-based learning approach. Overall, we conclude that our sequence-based approach, together with our performance optimization methods, enable us to detect malware under the performance demands of mobile devices.

DOI: 10.1109/ICECCS51672.2020.00015

Transcript

Introduction to the show: ident: Security Radio. Generated commentary on the latest security and cryptography papers.

Nadia: We're looking at the paper: "SeqMobile: A Sequence Based Efficient Android Malware Detection System Using RNN on Mobile Devices".

Elias: The gist The proposed SeqMobile system is an efficient sequence-based malware detection system that uses behavior-based sequence features and customized deep neural networks on mobile devices to effectively detect Android…

Nadia: First, who's behind it and why it matters.

Paper summary: Elias: To get into the specifics of "SeqMobile: A Sequence Based Efficient Android Malware Detection System Using RNN on Mobile Devices", the core idea is moving beyond just syntax features like permissions or API calls to using behavior-based sequences to capture what the app is actually doing.

Nadia: So instead of just looking at a list of what functions an app calls, they are constructing these sequences that have more meaning, which they say can represent potential malicious behaviors.

Priya: What I'm interested in is how they handle the data preparation because capturing that meaning without getting bogged down in too much noise is always a challenge in these types of systems.

Elias: They outline a systematic approach for feature preparation where they build feature dictionaries, then extract sequences and filter out redundant elements using those dictionaries.

Nadia: So the process involves selecting four specific feature sets: Permission, Intent filters, API call sequence, and Intent sequence. They even propose a repetitive elements removal method to boost performance with little effect on accuracy.

Priya: That feature selection process sounds like it tries to balance getting rich data with keeping the input manageable for the network.

Elias: For the deep learning part, they tested six basic neural networks, including single layer LSTM/GRU up through stacked and Bi-LSTM/GRU architectures. They found that the Bi-LSTM network was accepted as the best base model for achieving high accuracy.

Nadia: And that custom Bi-LSTM architecture includes an embedding layer to reduce dimensionality and a Bi-LSTM layer to keep track of context in both directions along the sequence.

Priya: Before they move it all onto the phone, they convert it into a TensorFlow Lite model, but they intentionally didn't do quantization because their experiments showed that dynamic prediction time was more advantageous for their specific network setup.

Elias: The deployment phase is where performance really comes into play; feature extraction from the target APK uses those constructed dictionaries, and a small but crucial part of it is implemented using native code for performance gains on lower-end devices.

Nadia: They also mentioned a specific trick there: they perform truncation to the input sequence but not padding, which they found results in the best accuracy and a shorter prediction time.

Elias: And they confirmed that their performance optimization methods have proven to improve the training and prediction time cost by at least twofold.

Nadia: That doubling of time reduction is significant because it directly addresses the performance demands of mobile devices where you can't afford long wait times.

Priya: But we gotta remember that even with this accuracy, they admit that while this approach is accurate, it still takes about ten times longer to run compared to some other systems they compared it against.

Nadia: So what we’re hearing is that SeqMobile is a concrete example of taking deep behavioral understanding and trying to make it fit into the real-world constraints of mobile computing.

Conclusion: Priya: So wrapping up this look at "SeqMobile: A Sequence Based Efficient Android Malware Detection System Using RNN on Mobile Devices", what they’re really pointing to is that capturing these sequences gives you more meaning about what the app is doing, which is better than just looking at a list of API calls.

Nadia: Right, and even though the sequence length was one thousand seven hundred for their best result, achieving this ninety-seven point eight five percent accuracy shows this method can be really effective in practice on devices.

Elias: They did a lot of work on optimizing the deployment pipeline too, like using native code and specific truncation techniques to reduce prediction time significantly.

Priya: The implication here is that for anyone building security tools meant to run locally on mobile, you have to balance getting that deep behavioral understanding with keeping the app running fast enough not to cause battery drain or lag.

Nadia: Exactly. It shows how you can get high accuracy by using sequence data while simultaneously making the system actually runnable on hardware that isn't top-tier.

Elias: And they’re handing out some guidance on the TensorFlow model optimization toolkit, which is something other teams leveraging sequence-based learning can use as a reference for their own speed improvements.

Priya: So it’s not just about the detection accuracy; it’s a blueprint for how to practically deploy these types of deep learning models efficiently on consumer hardware.

Nadia: That's what this paper delivers, showing that you can get high accuracy by using sequence data while simultaneously making the system actually runnable on hardware that isn't top-tier.

Priya: So it’s not just about the detection accuracy; it’s a blueprint for how to practically deploy these types of deep learning models efficiently on consumer hardware.

More episodes

← Home