GDroid: Android malware detection and classification with graph convolutional network

KronoDroid: Time-based Hybrid-featured Dataset for Effective Android Malware Detection and Characterization

Reading reference documentation is an important part of programming with application programming interfaces (APIs). Reference documentation complements the API by providing information not obvious from the API syntax. To improve the quality of reference documentation and the efficiency with which the relevant information it contains can be accessed, we must first understand its content. We report on a study of the nature and organization of knowledge contained in the reference documentation of the hundreds of APIs provided as a part of two major technology platforms: Java SDK 6 and .NET 4.0. Our study involved the development of a taxonomy of knowledge types based on grounded methods and independent empirical validation. Seventeen trained coders used the taxonomy to rate a total of 5,574 randomly sampled documentation units to assess the knowledge they contain. Our results provide a comprehensive perspective on the patterns of knowledge in API documentation: observations about the types of knowledge it contains and how this knowledge is distributed throughout the documentation. The taxonomy and patterns of knowledge we present in this paper can be used to help practitioners evaluate the content of their API documentation, better organize their documentation, and limit the amount of low-value content. They also provide a vocabulary that can help structure and facilitate discussions about the content of APIs.

Patterns of Knowledge in API Reference Documentation.

While machine-learning algorithms have demonstrated a strong ability in detecting Android malware, they can be evaded by sparse evasion attacks crafted by injecting a small set of fake components, e.g., permissions and system calls, without compromising intrusive functionality. Previous work has shown that, to improve robustness against such attacks, learning algorithms should avoid overemphasizing few discriminant features, providing instead decisions that rely upon a large subset of components. In this work, we investigate whether gradient-based attribution methods, used to explain classifiers' decisions by identifying the most relevant features, can be used to help identify and select more robust algorithms. To this end, we propose to exploit two different metrics that represent the evenness of explanations, and a new compact security measure called Adversarial Robustness Metric. Our experiments conducted on two different datasets and five classification algorithms for Android malware detection show that a strong connection exists between the uniformity of explanations and adversarial robustness. In particular, we found that popular techniques like Gradient*Input and Integrated Gradients are strongly correlated to security when applied to both linear and nonlinear detectors, while more elementary explanation techniques like the simple Gradient do not provide reliable information about the robustness of such classifiers.

Do Gradient-based Explanations Tell Anything About Adversarial Robustness to Android Malware?

The continuous increase and spread of malware have caused immeasurable losses to social enterprises and even the country, especially unknown malware. Most existing methods use predefined class samples to train models, which cannot handle unknown malware detection. In this paper, we formalize unknown malware detection as a Few-Shot Learning problem. However, the existing model cannot dynamically adjust the model parameters according to the samples and does not deeply consider the influence of the correlation between samples, so it achieves sub-optimal performance. We propose a Dynamic Prototype Network based on Sample Adaptation for few-shot malware detection (DPNSA). Specifically, we use dynamic convolution to realize dynamic feature extraction based on sample adaptation. Secondly, we define the class feature (prototype) as the mean of the dynamic embedding of all malware samples of each class in the support set. Then, a dual-sample dynamic activation function is proposed, which uses the correlation of the dual-sample to reduce the impact of unrelated features between samples on the metric. Finally, we use the metric-based method to calculate the distance between the query sample and the prototype to realize malware detection. Experiments show that our method outperforms the existing few-shot malware detection models and achieves significant improvement.

Dynamic Prototype Network Based on Sample Adaptation for Few-Shot Malware Detection

Machine learning (ML) classifiers have been widely deployed to detect Android malware, but at the same time the application of ML classifiers also faces an emerging problem. The performance of such classifiers degrades---or called ages---significantly over time given the malware evolution. Prior works have proposed to use retraining or active learning to reverse and improve aged models. However, the underlying classifier itself is still blind, unaware of malware evolution. Unsurprisingly, such evolution-insensitive retraining or active learning comes at a price, i.e., the labeling of tens of thousands of malware samples and the cost of significant human efforts. In this paper, we propose the first framework, called APIGraph, to enhance state-of-the-art malware classifiers with the similarity information among evolved Android malware in terms of semantically-equivalent or similar API usages, thus naturally slowing down classifier aging. Our evaluation shows that because of the slow-down of classifier aging, APIGraph saves significant amounts of human efforts required by active learning in labeling new malware samples.

https://dl.acm.org/doi/pdf/10.1145/3372297.3417291

Enhancing State-of-the-art Classifiers with API Semantics to Detect Evolved Android Malware

Context Persons living with HIV (PLWH) commonly experience mental health symptoms. However, little is known about the core mental health symptoms and their relationships. Objective This study aimed to evaluate the prevalence of various mental health symptoms and to explore their relationships in symptom networks among PLWH. Methods From April to July 2022, we recruited 518 participants through convenience sampling in Beijing, China, for this cross-sectional study. Forty mental health symptoms, including six dimensions (somatization symptoms, negative affect, cognitive function, interpersonal communication, cognitive processes, and social adaptation), were assessed through paper-based or online questionnaires. Network analysis was performed in Python 3.6.0 to explore the core mental health symptoms and describe the relationships among symptoms and clusters. Results Of the 40 mental health symptoms, the most common symptoms were fatigue (71.2%), trouble remembering things (65.6%), and uncertainty about the future (64.0%). In the single symptom network, sadness was the most central symptom across the three centrality indices (rS = 0.59, rC = 0.61, rB = 0.06), followed by feeling discouraged about the future (rS = 0.51, rC = 0.57, rB = 0.04) and feelings of worthlessness (rS = 0.54, rC = 0.53, rB = 0.05). In the symptom cluster network, negative affect was the most central symptom cluster across the three centrality indices (rS = 1, rC = 1, rB = 0.43). Conclusion Our study provides a new perspective on the role of each mental health symptom among PLWH. To alleviate the mental health symptoms of PLWH to the greatest extent possible and comprehensively improve their mental health, we suggest that psychological professionals pay more attention to pessimistic mood and cognitive processes in PLWH. Interventions that apply positive psychology skills and cognitive behavioral therapy may be necessary components for the mental health care of PLWH.

Yukun Zhang

Papers

Enhancing State-of-the-art Classifiers with API Semantics to Detect Evolved Android Malware

Exploring core mental health symptoms among persons living with HIV: A network analysis