A Malware Detection and Extraction Method for the Related Information Using the ViT Attention Mechanism on Android Operating System
Source abstract
Abstract
Artificial intelligence (AI) is increasingly being utilized in cybersecurity, particularly for detecting malicious applications. However, the black-box nature of AI models presents a significant challenge. This lack of transparency makes it difficult to understand and trust the results. In order to address this, it is necessary to incorporate explainability into the detection model. There is insufficient research to provide reasons why applications are detected as malicious or explain their behavior. In this paper, we propose a method of a Vision Transformer(ViT)-based malware detection model and malicious behavior extraction using an attention map to achieve high detection accuracy and high interpretability. Malware detection uses a ViT-based model, which takes an image as input. ViT offers a significant advantage for image detection tasks by leveraging attention mechanisms, enabling robust interpretation and understanding of the intricate patterns within the images. The image is converted from an application. An attention map is generated with attention values generated during the detection process. The attention map is used to identify factors that the model deems important. Class and method names are extracted and provided based on the identified factors. The performance of the detection was validated using real-world datasets. The malware detection accuracy was 80.27%, which is a high level of accuracy compared to other models used for image-based malware detection. The interpretability was measured in the same way as the F1-score, resulting in an interpretability score of 0.70. This score is superior to existing interpretable machine learning (ML)-based methods, such as Drebin, LIME, and XMal. By analyzing malicious applications, we also confirmed that the extracted classes and methods are related to malicious behavior. With the proposed method, security experts can understand the reason behind the model’s detection and the behavior of malicious applications. Given the growing importance of explainable artificial intelligence in cybersecurity, this method is expected to make a significant contribution to this field.
Source: crossref · Quality: baseline
Research context
OpenAlex topics: Advanced Malware Detection Techniques · Adversarial Robustness in Machine Learning · Anomaly Detection Techniques and Applications
SciVX discovery tags are terminology-based. OpenAlex topics are source-provided classifications.
Affiliations
Department of Information Security, Korea University, Seoul 02841, Republic of Korea
Department of Computer Science, Lewis University, Romeoville, IL 60446, USA
References (45)
Show source-provided references
1. Šembera, V., Paquet-Clouston, M., Garcia, S., and Erquiaga, M.J. (2021, January 6–10). Cybercrime specialization: An exposé of a malicious Android Obfuscation-as-a-Service. Proceedings of the 2021 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW), Vienna, Austria.10.1109/EuroSPW54576.2021.00029 ↗
2. A review of android malware detection approaches based on machine learning10.1109/ACCESS.2020.3006143 ↗
3. Deep learning for android malware defenses: A systematic literature review
4. Freitas, S., Duggal, R., and Chau, D.H. (2022, January 17–21). MalNet: A Large-Scale Image Database of Malicious Software. Proceedings of the 31st ACM International Conference on Information & Knowledge Management, Atlanta, GA, USA.10.1145/3511808.3557533 ↗
5. Gerlings, J., Shollo, A., and Constantiou, I. (2020). Reviewing the need for explainable artificial intelligence (xAI). arXiv.10.24251/HICSS.2021.156 ↗
6. Perarasi, T., Vidhya, S., and Ramya, P. (2020, January 15–17). Malicious vehicles identifying and trust management algorithm for enhance the security in 5G-VANET. Proceedings of the 2020 Second International Conference on Inventive Research in Computing Applications (ICIRCA), Coimbatore, India.10.1109/ICIRCA48905.2020.9183184 ↗
7. Towards an interpretable deep learning model for mobile malware detection and family identification10.1016/j.cose.2021.102198 ↗
8. Towards explainable CNNs for Android malware detection10.1016/j.procs.2021.03.118 ↗
9. Why an android app is classified as malware: Toward malware classification interpretation10.1145/3423096 ↗
10. Zhang, Z., Hamadi, H.A., Damiani, E., Yeun, C.Y., and Taher, F. (2022). Explainable Artificial Intelligence Applications in Cyber Security: State-of-the-Art in Research. arXiv.10.1109/ACCESS.2022.3204051 ↗
11. Liu, H., Yin, Q., and Wang, W.Y. (2018). Towards explainable NLP: A generative explanation framework for text classification. arXiv.10.18653/v1/P19-1560 ↗
12. Alzahrani, N., and Alghazzawi, D. (2019, January 12–14). A review on android ransomware detection using deep learning techniques. Proceedings of the 11th International Conference on Management of Digital EcoSystems, Limassol, Cyprus.10.1145/3297662.3365785 ↗
13. Zhang, Y., Yang, Y., and Wang, X. (2018, January 16–18). A novel android malware detection approach based on convolutional neural network. Proceedings of the 2nd International Conference on Cryptography, Security and Privacy, Guiyang, China.10.1145/3199478.3199492 ↗
14. Effective android malware detection with a hybrid model based on deep autoencoder and convolutional neural network10.1007/s12652-018-0803-6 ↗
15. End-to-end malware detection for android IoT devices using deep learning10.1016/j.adhoc.2020.102098 ↗
16. Hsien-De Huang, T., and Kao, H.Y. (2018, January 10–13). R2-d2: Color-inspired convolutional neural network (cnn)-based android malware detections. Proceedings of the 2018 IEEE International Conference on Big Data (Big Data), Seattle, DC, USA.10.1109/BigData.2018.8622324 ↗
17. Daoudi, N., Samhi, J., Kabore, A.K., Allix, K., Bissyandé, T.F., and Klein, J. (2021, January 15). Dexray: A simple, yet effective deep learning approach to android malware detection based on image representation of bytecode. Proceedings of the Deployable Machine Learning for Security Defense: Second International Workshop, MLHat 2021, Virtual.10.1007/978-3-030-87839-9_4 ↗
18. EfficientNet convolutional neural networks-based Android malware detection10.1016/j.cose.2022.102622 ↗
19. Yakura, H., Shinozaki, S., Nishimura, R., Oyama, Y., and Sakuma, J. (2018, January 19–21). Malware analysis of imaged binary samples by convolutional neural network with attention mechanism. Proceedings of the Eighth ACM Conference on Data and Application Security and Privacy, Tempe, AZ, USA.10.1145/3176258.3176335 ↗
20. Dosovitskiy, A., Beyer, L., Kolesnikov, A., Weissenborn, D., Zhai, X., Unterthiner, T., Dehghani, M., Minderer, M., Heigold, G., and Gelly, S. (2020). An image is worth 16x16 words: Transformers for image recognition at scale. arXiv.
21. Transformers in vision: A survey10.1145/3505244 ↗
22. Attention is all you need
23. Zhao, H., Jia, J., and Koltun, V. (2020, January 13–19). Exploring self-attention for image recognition. Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, Seattle, WA, USA.10.1109/CVPR42600.2020.01009 ↗
24. Abnar, S., and Zuidema, W. (2020). Quantifying attention flow in transformers. arXiv.10.18653/v1/2020.acl-main.385 ↗
25. Selvaraju, R.R., Cogswell, M., Das, A., Vedantam, R., Parikh, D., and Batra, D. (2017, January 22–29). Grad-cam: Visual explanations from deep networks via gradient-based localization. Proceedings of the IEEE International Conference on Computer Vision, Venice, Italy.10.1109/ICCV.2017.74 ↗
26. Zhou, B., Khosla, A., Lapedriza, A., Oliva, A., and Torralba, A. (2016, January 27–30). Learning deep features for discriminative localization. Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, Las Vegas, NA, USA.10.1109/CVPR.2016.319 ↗
27. Chefer, H., Gur, S., and Wolf, L. (2021, January 19–25). Transformer interpretability beyond attention visualization. Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, Virtual.10.1109/CVPR46437.2021.00084 ↗
28. (2023, January 07). JADX. Available online: https://github.com/skylot/jadx.
29. (2023, January 07). dex2jar. Available online: https://github.com/pxb1988/dex2jar.
30. (2023, January 07). Apktool. Available online: https://ibotpeaches.github.io/Apktool/.
31. An automated vision-based deep learning model for efficient detection of android malware attacks10.1109/ACCESS.2022.3140341 ↗
32. Wang, Q., Li, B., Xiao, T., Zhu, J., Li, C., Wong, D.F., and Chao, L.S. (2019). Learning deep transformer models for machine translation. arXiv.10.18653/v1/P19-1176 ↗
33. Ba, J.L., Kiros, J.R., and Hinton, G.E. (2016). Layer normalization. arXiv.
34. (2022, December 14). Dalvik Executable Format. Available online: https://source.android.com/docs/core/runtime/dex-format.
35. Arras, L., Osman, A., and Samek, W. (2020). Ground truth evaluation of neural network explanations with clevr-xai. arXiv.10.18653/v1/W19-4813 ↗
36. Allix, K., Bissyandé, T.F., Klein, J., and Le Traon, Y. (2016, January 14–15). AndroZoo: Collecting Millions of Android Apps for the Research Community. Proceedings of the 13th International Conference on Mining Software Repositories, Austin, TX, USA.10.1145/2901739.2903508 ↗
37. Hurier, M., Suarez-Tangil, G., Dash, S.K., Bissyandé, T.F., Traon, Y.L., Klein, J., and Cavallaro, L. (2017, January 20–28). Euphony: Harmonious unification of cacophonous anti-virus vendor labels for Android malware. Proceedings of the 14th International Conference on Mining Software Repositories, Buenos Aires, Argentina.10.1109/MSR.2017.57 ↗
38. Mahdavifar, S., Kadir, A.F.A., Fatemi, R., Alhadidi, D., and Ghorbani, A.A. (2020, January 17–22). Dynamic android malware category classification using semi-supervised deep learning. Proceedings of the 2020 IEEE Intlernational Conference on Dependable, Autonomic and Secure Computing, Intlernational Conference on Pervasive Intelligence and Computing, Intlernational Conference on Cloud and Big Data Computing, Intlernational Conference on Cyber Science and Technology Congress (DASC/PiCom/CBDCom/CyberSciTech), Calgary, AB, Canada.10.1109/DASC-PICom-CBDCom-CyberSciTech49142.2020.00094 ↗
39. Effective and efficient hybrid android malware classification using pseudo-label stacked auto-encoder10.1007/s10922-021-09634-4 ↗
40. He, K., Zhang, X., Ren, S., and Sun, J. (2016, January 27–30). Deep residual learning for image recognition. Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, Las Vegas, NV, USA.10.1109/CVPR.2016.90 ↗
41. Huang, G., Liu, Z., Van Der Maaten, L., and Weinberger, K.Q. (2017, January 21–26). Densely connected convolutional networks. Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, Honolulu, HI, USA.10.1109/CVPR.2017.243 ↗
42. Sandler, M., Howard, A., Zhu, M., Zhmoginov, A., and Chen, L.C. (2018, January 18–22). Mobilenetv2: Inverted residuals and linear bottlenecks. Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, Salt Lake City, UT, USA.10.1109/CVPR.2018.00474 ↗
43. Drebin: Effective and explainable detection of android malware in your pocket
44. Ribeiro, M.T., Singh, S., and Guestrin, C. (2016, January 13–17). “Why should i trust you?”. Explaining the predictions of any classifier. Proceedings of the 22nd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, San Francisco, CA, USA.10.1145/2939672.2939778 ↗
45. Duan, Y., Zhang, M., Bhaskar, A.V., Yin, H., Pan, X., Li, T., Wang, X., and Wang, X. (2018, January 18–21). Things You May Not Know About Android (Un) Packers: A Systematic Study based on Whole-System Emulation. Proceedings of the NDSS, San Diego, CA, USA.10.14722/ndss.2018.23296 ↗