DeepFlow: Deep learning-based malware detection by mining Android application for abnormal usage of sensitive data

• Published in: 2017 IEEE Symposium on Computers and Communications (ISCC) pp. 438 - 443
• Main Authors: Dali Zhu, Hao Jin, Ying Yang, Di Wu, Weiyi Chen
• Format: Conference Proceeding
• Language: English
• Published: IEEE 01-07-2017
• Subjects: Android malware detection; Androids; characterization; Computational modeling; data flows; Data mining; deep learning; Feature extraction; Humanoid robots; Machine learning; Malware
• DOI: 10.1109/ISCC.2017.8024568

The open nature of Android allows application developers to take full advantage of the system. While the flexibility is brought to developers and users, it may raise significant issues related to malicious applications. Traditional malware detection approaches based on signatures or abnormal behaviors are invalid when dealing with novel malware. To solve the problem, machine learning algorithms are used to learn the distinctions between malware and benign apps automatically. Deep learning, as a new area of machine learning, is developing rapidly as its better characterization of samples. We thus propose DeepFlow, a novel deep learning-based approach for identifying malware directly from the data flows in the Android application. We test DeepFlow on thousands of benignware and malware. The results show that DeepFlow can achieve a high detection F1 score of 95.05%, outperforming traditional machine learning-based approaches, which reveals the advantage of deep learning technique in malware detection.