Obfuscated Malware Detection in IoT Android Applications Using Markov Images and CNN

The threat of malware in the Internet of Things (IoT) is ever-present given that many IoT systems today rely on the Android operating system. There has been a consistent rise in Android malware recently, with new variants adopting sophisticated detection avoidance techniques, including various forms...

Full description

Saved in:

Bibliographic Details
Published in:	IEEE systems journal Vol. 17; no. 2; pp. 1 - 11
Main Authors:	A, Dhanya K., P, Vinod, Yerima, Suleiman Y., Bashar, Abul, David, Anwin, T, Abhiram, Antony, Alan, Shavanas, Ashil K., T, Gireesh Kumar
Format:	Journal Article
Language:	English
Published:	New York IEEE 01-06-2023 The Institute of Electrical and Electronics Engineers, Inc. (IEEE)
Subjects:	Accuracy Android malware Artificial neural networks Classification Codes Convolutional neural networks convolutional neural networks (CNNs) deep learning Feature extraction Internet of Things Internet of Things (IoT) Malware Markov images Markov processes Mathematical models Model accuracy obfuscated malware Visualization
Online Access:	Get full text
Tags:	Add Tag No Tags, Be the first to tag this record!

Description
Summary:	The threat of malware in the Internet of Things (IoT) is ever-present given that many IoT systems today rely on the Android operating system. There has been a consistent rise in Android malware recently, with new variants adopting sophisticated detection avoidance techniques, including various forms of obfuscation. Hence, there is a need to improve the effectiveness of Android malware detection as obfuscation becomes more prevalent in the wild. In this article, we present a novel approach for obfuscated malware detection in IoT Android applications based on the visualization of app executables with Markov images. The app images are trained using a convolutional neural network (CNN) to detect obfuscated malware and for the identification of the obfuscation type. We evaluate the performance of the proposed system by experimenting with four different classification models using 12000 Android applications. The CNN model created to distinguish between malware and benign apps obtained an accuracy of 99.41%. The model for identifying obfuscated malware from benign applications obtained 99.65% accuracy while the model created to identify obfuscated malware from non-obfuscated malware yielded an accuracy of 99.81%. The model for classifying obfuscated malware into 14 different obfuscation categories obtained an accuracy of 99.67%. These results show that CNN models trained from Markov images generated using application byte code can be highly effective for obfuscated malware detection and classification. Moreover, our proposed system provides a more sustainable and cost-effective method for obfuscated malware detection compared to the manual feature-engineering-based approaches that are more prevalent in the current literature.
ISSN:	1932-8184 1937-9234
DOI:	10.1109/JSYST.2023.3238678