SeqMobile: A Sequence Based Efficient Android Malware Detection System Using RNN on Mobile Devices

arXiv:2011.05218 · cs.CR, cs.SE · Submitted 2020-11-10 · Read on arXiv

Listen

Transcript

Introduction to the show: ident: Security Radio. Generated commentary on the latest security and cryptography papers.

Nadia: We're looking at the paper: "SeqMobile: A Sequence Based Efficient Android Malware Detection System Using RNN on Mobile Devices".

Elias: The gist The proposed SeqMobile system is an efficient sequence-based malware detection system that uses behavior-based sequence features and customized deep neural networks on mobile devices to effectively detect Android…

Nadia: First, who's behind it and why it matters.

Paper summary: Elias: To get into the specifics of "SeqMobile: A Sequence Based Efficient Android Malware Detection System Using RNN on Mobile Devices", the core idea is moving beyond just syntax features like permissions or API calls to using behavior-based sequences to capture what the app is actually doing.

Nadia: So instead of just looking at a list of what functions an app calls, they are constructing these sequences that have more meaning, which they say can represent potential malicious behaviors.

Priya: What I'm interested in is how they handle the data preparation because capturing that meaning without getting bogged down in too much noise is always a challenge in these types of systems.

Elias: They outline a systematic approach for feature preparation where they build feature dictionaries, then extract sequences and filter out redundant elements using those dictionaries.

Nadia: So the process involves selecting four specific feature sets: Permission, Intent filters, API call sequence, and Intent sequence. They even propose a repetitive elements removal method to boost performance with little effect on accuracy.

Priya: That feature selection process sounds like it tries to balance getting rich data with keeping the input manageable for the network.

Elias: For the deep learning part, they tested six basic neural networks, including single layer LSTM/GRU up through stacked and Bi-LSTM/GRU architectures. They found that the Bi-LSTM network was accepted as the best base model for achieving high accuracy.

Nadia: And that custom Bi-LSTM architecture includes an embedding layer to reduce dimensionality and a Bi-LSTM layer to keep track of context in both directions along the sequence.

Priya: Before they move it all onto the phone, they convert it into a TensorFlow Lite model, but they intentionally didn't do quantization because their experiments showed that dynamic prediction time was more advantageous for their specific network setup.

Elias: The deployment phase is where performance really comes into play; feature extraction from the target APK uses those constructed dictionaries, and a small but crucial part of it is implemented using native code for performance gains on lower-end devices.

Nadia: They also mentioned a specific trick there: they perform truncation to the input sequence but not padding, which they found results in the best accuracy and a shorter prediction time.

Elias: And they confirmed that their performance optimization methods have proven to improve the training and prediction time cost by at least twofold.

Nadia: That doubling of time reduction is significant because it directly addresses the performance demands of mobile devices where you can't afford long wait times.

Priya: But we gotta remember that even with this accuracy, they admit that while this approach is accurate, it still takes about ten times longer to run compared to some other systems they compared it against.

Nadia: So what we’re hearing is that SeqMobile is a concrete example of taking deep behavioral understanding and trying to make it fit into the real-world constraints of mobile computing.

Conclusion: Priya: So wrapping up this look at "SeqMobile: A Sequence Based Efficient Android Malware Detection System Using RNN on Mobile Devices", what they’re really pointing to is that capturing these sequences gives you more meaning about what the app is doing, which is better than just looking at a list of API calls.

Nadia: Right, and even though the sequence length was one thousand seven hundred for their best result, achieving this ninety-seven point eight five percent accuracy shows this method can be really effective in practice on devices.

Elias: They did a lot of work on optimizing the deployment pipeline too, like using native code and specific truncation techniques to reduce prediction time significantly.

Priya: The implication here is that for anyone building security tools meant to run locally on mobile, you have to balance getting that deep behavioral understanding with keeping the app running fast enough not to cause battery drain or lag.

Nadia: Exactly. It shows how you can get high accuracy by using sequence data while simultaneously making the system actually runnable on hardware that isn't top-tier.

Elias: And they’re handing out some guidance on the TensorFlow model optimization toolkit, which is something other teams leveraging sequence-based learning can use as a reference for their own speed improvements.

Priya: So it’s not just about the detection accuracy; it’s a blueprint for how to practically deploy these types of deep learning models efficiently on consumer hardware.

Nadia: That's what this paper delivers, showing that you can get high accuracy by using sequence data while simultaneously making the system actually runnable on hardware that isn't top-tier.

Priya: So it’s not just about the detection accuracy; it’s a blueprint for how to practically deploy these types of deep learning models efficiently on consumer hardware.

School of Computer Science and Engineering, Nanyang Technological University · College of Intelligence and Computing, Tianjin University

cs.CR, cs.SE

Submitted: 2020-11-10

Updated: 2020-11-10

Comments: ICECCS-2020

DOI: 10.1109/ICECCS51672.2020.00015

Code: https://github.com/tensorflow/tensorflow

License: http://creativecommons.org/licenses/by/4.0/

Importance score: 89/100

The gist: The gist The proposed SeqMobile system is an efficient sequence-based malware detection system that uses behavior-based sequence features and customized deep neural networks on mobile devices to

Key concepts

Behavior-based Sequence Features: Instead of just looking at a list of permissions or API calls (syntax), this method analyzes the order and flow of actions an app takes. This sequence information captures the potential malicious behavior, giving the detection system deeper meaning about what an application is doing, which helps distinguish malware from safe apps.
Customized Bi-LSTM Network: The system uses a Bidirectional Long Short-Term Memory (Bi-LSTM) network as its core classifier. This network reads the input sequence in both forward and backward directions simultaneously, allowing it to capture complex contextual information from the entire sequence, leading to higher detection accuracy compared to simpler neural networks.
Performance Optimization Methods: To ensure fast operation on mobile phones, SeqMobile uses several tricks. These include using native code for feature extraction and a repetitive element removal technique. These methods reduce the input size and processing time without significantly hurting the system's ability to accurately identify malware.
Dynamic Prediction Time: The model is designed to have prediction times that change based on how long the extracted sequence is. This dynamic approach allows for better performance management, as it can be optimized for different sequence lengths, leading to faster results when necessary.

Terminology

Accuracy — 4× in this paper · explained in 1 episode
Feature Extraction — 1× in this paper · explained in 3 episodes

Summary

The gist The proposed SeqMobile system is an efficient sequence-based malware detection system that uses behavior-based sequence features and customized deep neural networks on mobile devices to effectively detect Android malware under performance demands

How it works

SeqMobile adopts behavior-based sequence features and customized deep neural networks to provide an effective and efficient malware detection service on Android devices. The system is designed to address the limitations of existing device-end learning based solutions that extract limited syntax features, such as permissions and API calls, by leveraging sequence-based features which lack semantics but can represent potential malicious behaviors. To meet the performance demand on mobile devices, SeqMobile accepts three effective performance optimization methods to reduce the time of feature extraction and prediction.

Feature Preparation

The feature preparation step focuses on extracting features as sequences such that they can provide more semantics to help distinguish between malicious and benign behaviors inside Android applications. The process involves several systematic steps:

A set of feature dictionaries will be constructed.
Feature sequences are extracted and used to filter out the redundant elements using the constructed dictionaries.
Each element in the filtered sequence is represented with a unique integer identifier and passed into the proposed network for training.

The feature selection process involves selecting 4 feature sets based on analysis against Android malware, which include Permission, Intent filters, API call sequence, and Intent sequence. The selected features are N(Permission), N(Intent), S(API calls), and S(Intent). A repetitive elements removal method is proposed to remove repetitive elements in sequences to boost performance with little effect on accuracy.

Deep Learning Model Construction

To discover the usability of different neural networks, six basic neural networks were presented for training the classifier, including single layer LSTM/GRU, stacked LSTM/GRU, and Bi-LSTM/GRU. The BiLSTM network was accepted as the basic network due to yielding the highest accuracy. The customized BiLSTM network architecture incorporates an embedding layer to reduce dimensionality and a Bi-LSTM layer to preserve contextual information from both forward and backward along the sequence.

Model Conversion and Optimization

The pre-trained model is converted into a TensorFlow Lite model using TFLiteConverter. The authors decided not to perform quantization because experiments showed it was more advantageous for their proposed network, allowing for dynamic prediction time where the prediction time cost is dependent on the extracted sequence length.

Real Time Detection System

In the deployment phase, feature extraction is performed from the target APK using constructed dictionaries. To improve performance, a small but crucial part of the feature extraction module is implemented using native code where a performance gain can be observed even on lower-end devices. The system performs truncation to the input sequence but not padding, which results in achieving the best accuracy and a shorter prediction time.

Performance Evaluation

The experiments evaluated detection accuracy across different feature categories, sequence lengths, and deep neural networks. The customized Bi-LSTM network with the feature set combination N(Permission), N(Intent), and S(API calls, Intent) achieved an accuracy of 97.85% when the sequence length was 1,700. The repetitive elements removal method showed insignificant effects on learning ability but improved training and prediction performance in terms of time cost. The JNI implementation for feature extraction improved performance by approximately 21% on flagship phones. Furthermore, the repetitive element removal method reduced the sequence length by approximately 57%, which directly translates to an improvement in prediction time of at least twofold. The non-quantized dynamic BiLSTM model was observed to be much faster than the quantized static Bi-LSTM model on flagship phones, with a reduction in average time cost of approximately 45%.

Comparison between previous work and SeqMobile

SeqMobile's sequence-based approach, which contains additional semantics, was able to achieve a much higher accuracy (i.e., 97.85%) compared to MobiDroid (97.35%) and MobiTive (96.75%). Although the time cost is still approximately 10 times higher when compared to MobiTive, the high accuracy is a key factor. The paper concludes that their sequence-based approach, together with performance optimization methods, enables efficient malware detection under mobile device performance demands

Conclusion

In this paper, the authors investigated the effectiveness of using a sequence-based learning approach together with performance optimization methods to detect malicious applications on device end. The evaluation results show that their approach achieves a high accuracy (97.85%) and a reasonable detection time on flagship phones Moreover, they provided guidance on the state-of-the-art TensorFlow model optimization toolkit for device-end sequence-based approaches

Acknowledgments

This work was supported by Singapore Ministry of Education Academic Research Fund Tier 1 (Award No. 2018-T1-002-069), the National Research Foundation, Prime Ministers Office, Singapore under its National Cybersecurity R&D Program (Award No. NRF2018 NCR-NCR005-0001), the Singapore National Research Foundation under NCR Award Number NSOE003-0001, NRF Investigatorship NRFI06-2497, and the National Natural Science Foundation of China (No. 61952395)

References

[1] S. Chen, T. Su, L. Fan, G. Meng, M. Xue, Y. Liu, and L. Xu “Are mobile banking apps secure? what can be improved?” in FSE 2018

[2] S. Chen, L. Fan, G. Meng, T. Su, M. Xue, Y. Xue, Y Liu and L Xu “An empirical assessment of security risks of global android banking apps” in ICSE 2020

[3] C Tang, S Chen, L Fan, L Xu Y Liu Z Tang and L Dou “A large-scale empirical study on industrial fake apps” in ICSE 2019

[4] S Chen, M Xue, Z Tang, L Xu and H Zhu “Stormdroid: A streaminglized machine learning-based system for detecting Android malware” in AsiaCCS 2016

[5] S Chen, M Xue, L Fan, S Hao, L Xu H Zhu and B Li “Automated poisoning attacks and defenses in malware detection systems: An adversarial machine learning approach” Computers & Security 2018

[6] D Arp M Spreitzenbarth M Hubner H Gascon K Rieck and C Siemens “Drebin: Effective and explainable detection of Android malware in your pocket” in NDSS 2014

[7] R Feng, S Chen, X Xie, L Ma G Meng Y Liu and S-W Lin “MobiDroid: A performance-sensitive malware detection system on mobile platform” in ICECCS 2019

[8] R Feng, S Chen, X Xie G Meng S-W Lin and Y Liu “A performance-sensitive malware detection system using deep learning on mobile devices” arXiv preprint arXiv:2005.04970 2020

[9] N McLaughlin J Martinez del Rincon B Kang S Yerima P Miller S Sezer Y Safaei E Trickel Z Zhao A Doupe´ et al “Deep android malware detection” in CODASPY 2017

[10] R Nix and J Zhang “Classification of Android apps and malware using deep neural networks” in 2017 IJCNN

[11] Q Jerome K Allix R State and T Engel “Using opcode-sequences to detect malicious Android applications” in 2014 ICC

[12] Java native interface JNI framework [Online] Available: https://docs.oracle.com/javase/7/docs/technotes/guides/jni/spec/jniTOC.html

[13] Tensorflow [Online] Available: https://www.tensorflow.org/

[14] Model optimization [Online] Available: https://www.tensorflow.org/lite/performance/model optimization

[15] Tensorflow Lite [Online] Available: https://www.tensorflow.org/lite/

[16] S Verma and S Muttoo “An Android malware detection frameworkbased on permissions and intents” Defence Science Journal 2016

[17] H K et al “Detecting and classifying Android malware using static analysis along with creator information” International Journal of Distributed Sensor Networks 2015

[18] A Feizollah N Anuar R Salleh G Suarez-Tangil and S Furnell “Androdialysis: Analysis of Android intent effectiveness in malware detection” Computers & Security vol.

Improvements for AI systems

The SeqMobile system can achieve high accuracy (97.85%) while maintaining a prediction time cost of less than 5 seconds on mobile devices, as shown by its performance optimization methods which have proven to improve the performance of training and prediction by at least twofold.
The system can effectively detect malware by leveraging behavior-based sequence features, specifically combining Permission, Intent filters, and two sequential features: API call sequence and Intent sequence, to represent semantic malicious behaviors.
The feature extraction module can be optimized for real-time detection by implementing parts of the feature extraction module using native code via JNI, which can improve the performance of the feature extraction module by approximately 21% on flagship phones.
The system can adapt its prediction time cost dynamically based on sequence length; specifically, our method reduces the sequence length by approximately 57%, which directly translates to an improvement in prediction time of at least twofold.
The model deployment can be optimized for varied mobile hardware by favoring a non-quantized dynamic Bi-LSTM over a quantized static model because the non-quantized version allows for variable length input and avoids the performance penalty of padding or truncation required by quantized models.

Abstract

With the proliferation of Android malware, the demand for an effective and efficient malware detection system is on the rise. The existing device-end learning based solutions tend to extract limited syntax features (e.g., permissions and API calls) to meet a certain time constraint of mobile devices. However, syntax features lack the semantics which can represent the potential malicious behaviors and further result in more robust model with high accuracy for malware detection. In this paper, we propose an efficient Android malware detection system, named SeqMobile, which adopts behavior-based sequence features and leverages customized deep neural networks on mobile devices instead of the server. Different from the traditional sequence-based approaches on server, to meet the performance demand, SeqMobile accepts three effective performance optimization methods to reduce the time cost. To evaluate the effectiveness and efficiency of our system, we conduct experiments from the following aspects 1) the detection accuracy of different recurrent neural networks; 2) the feature extraction performance on different mobile devices, 3) the detection accuracy and prediction time cost of different sequence lengths. The results unveil that SeqMobile can effectively detect malware with high accuracy. Moreover, our performance optimization methods have proven to improve the performance of training and prediction by at least twofold. Additionally, to discover the potential performance optimization from the SOTA TensorFlow model optimization toolkit for our approach, we also provide an evaluation on the toolkit, which can serve as a guidance for other systems leveraging on sequence-based learning approach. Overall, we conclude that our sequence-based approach, together with our performance optimization methods, enable us to detect malware under the performance demands of mobile devices.