Android Malware Detection Based On Deep Learning

Due to the rapid development of the Internet,smart terminals have become fundamental personal equipment.But Android security incidents occurred frequently in recent years.On the one hand,the openness of Android markets plays an important role in the popularity of Android apps.On the other hand,Android apps have become the target of many malicious attackers.The accuracy of large-scale Android malware detection should be improved and the method to detect Android malware should be upgraded.To improve the accuracy and efficiency of large-scale Android malware detection,we reconstruct the high-dimensional features of Android applications and employ multiple CNN to detect Android malware.In the serial convolutional neural network architecture(CNN-S),the convolutional layer and pooling layer are combined with the full-connection layer to enhance feature extraction capability.The depth of CNN-S is 5.In the parallel convolutional neural network architecture(CNN-P),three multiple filters with different window sizes are set to extract multiple features.The features are imported to a fully connected layer to classify Android applications.We use "dropout" to prevent over-fitting.We conduct experiments on 10000 benign applications and 13000 malicious applications.Under these conditions,both CNN-S model and CNN-P model show powerful ability in detecting Android malware.In details,the accuracy of Android malware detection using CNN-S model is 99.82%.Compared with SVM,the accuracy with the CNN-S model is improved by 5%.Simultaneously,we also conduct experiments using sigmoid and Relu as the activation function separately.The results prove that Relu can improve the accuracy by 2%.To reduce the training time and bring out the power of CNN,we combine Deep sparse Autoencoder(DAE)with CNN-S to build a model named DAE-CNN-S.Using DAE as a pre-training method can capture the essential features of Android apps efficiently.We extract the output of hidden layer in DAE and use it as the input of CNN-S model to achieve the Android malware detection.With the combination,DAE-CNN-S model can learn more flexible patterns in a short time.The training time using DAE-CNN model is reduced by 82%compared with CNN-S model.Compared with SVM,the accuracy with the DAE-CNN-S model is improved by 3%.To improve the accuracy of Android multi-category classification,we reconstruct the CNN-S model.We conduct experiments on 15801 benign applications which can be divided into 5 categories.The accuracy of Android multi-category classification using CNN-S model achieves 96%which is higher than SVM.It can still perform well with an unbalanced dataset.