Adversarial Malware Detection Based On Multi-task Learning

With the continuous development of the smart mobile phones technology in China,mobile devices are becoming more important in the people's daily life.Due to the advantages of the android operating system,such as open-source and portability.Nearly 80% of the smart devices in the domestic market are based on the android operating system,which makes it vulnerable towards malicious attacks.The extensive growth of the malicious software has created the severe problems for the users.In the recent years,security researchers have applied data mining and machine learning to the detection of malicious samples.While,the machine learning,even advanced with the deep learning,has been proved to be vulnerable to the adversary attacks,in these attacks the samples are formulated by adding small disturbances to it.So that the model will misclassify the adversary samples,making it to breakout the model detection.Therefore,how to improve the robustness of the malware detection system when it is attacked has a certain practical significance.This thesis summarizes the advantages and disadvantages of the research on the android malware detection at local and global levels.Furthermore it aims at the current android problem of low level detection of adversarial malicious samples in malware detection,Proposing the adversarial malware detection based on the multi-task learning.By using the multi-task learning model,the domain knowledge contained in the supervision signals of related tasks can be studied and used.To recognize the advantages of improving generalization performance,we divide the android software samples into different sample spaces.According to the software function categories in the application market,and combine the target of malware classification task and application classification task in the multi-task architecture to improve the effect of malware classification.Secondly,to improve the robustness of the attack model on the counter samples,the virtual counter malicious samples are made to train the model in the experiment and compared with the single task deep neural network model and distillation learning.Finally,the experimental results show that the detection rate of the proposed multi task detection model after confrontation training is 12.57% higher than that of the single task model(when the confrontation sample reaches 450),and the original detection performance of the detection model is less affected,and the false error rate is reduced by 3.79%.At the same time,compared with the distillation learning model,the detection rate is also improvedby 2.16%,and the false positive rate is also lower.