Authors:
Chirag Jaju
1
;
Dhairya Agrawal
1
;
Rishi Poddar
1
;
Shubh Badjate
1
;
Sidharth Anand
1
;
Barsha Mitra
1
and
Soumyadeep Dey
2
Affiliations:
1
Department of CSIS, BITS Pilani, Hyderabad Campus, Hyderabad, India
;
2
Microsoft India, India
Keyword(s):
Android Malware, APK, Image Conversion, CNN, Classification.
Abstract:
In recent years, the popularity of Android as a mobile operating system has grown exponentially and so it has been widely used in a huge array of mobile phones. This large scale proliferation of Android has resulted in it being extensively targeted by malware. Numerous families of malware have been developed with the sole purpose of infecting mobile phones and perpetrating different types of attacks on these devices and their users. Naturally, in the past few years, researchers have focused on developing strategies for detecting and classifying malware families. A large number of such strategies are based on converting the malware APK files to grayscale or color images. In this paper, we survey six APK to image conversion techniques and perform a comparative empirical analysis of these methods with respect to malware detection and classification. We implement the six approaches to convert the benign as well as malware binaries into images and then use three CNN-based models to distin
guish between benign and malware files and also to classify the various malware families. We use two very popular open-source Android malware datasets, CICAndMal2017 and the Drebin dataset for comparing the performance of the different image conversion techniques for the detection and classification tasks in terms of accuracy and F1-score. The results of the study provide insights into the relative performance of these approaches and help to determine the combination of the image conversion approach and the classification model that provides the best detection and classification performance.
(More)