A Deep Learning Approach for Android Malware Detection Using Mixed Bytecode Images and Attention-Based ResNet

Abstract

In an era, where apps are on the rise and taking over almost everything we do on our devices, detecting Android malware becomes of utmost importance. This work proposes a deep learning framework that can overcome those constraints in signature-based detection while against new and ever evolving flavors of malware. This technique consists in converting an Android application bytecode, into set of images which represent dynamic (behaviour and structure) features the program. It is these images that will be are basis for applying complex image classification methods effectively to detect malware. At the heart of this framework is an attention-amplified ResNet, one of the revolutionary convolutional neural network structures that can be used for image recognition. The introduction of the attention mechanism permits the model to pay more (less) attention on certain portions in the corresponding bytecode images, which helps boost its capacity for distinguishing benign and malicious applications with higher focus weights. The approach increases the generalization properties of a model to varying malware families and improves its adversarial robustness for withstanding new evasion strategies by using bytecode images that are mixed, i.e., original as well as augmented versions. Experiments on a large dataset of Android applications show that inaccuracy, precision and recall performed jointly polished than current models dosing malware detection. It turns out that the attention mechanism plays an important role for improving detection performance, especially on heavily obfuscated malware. Furthermore, the application of mixed bytecode images reduces false positives and increases accuracy to a level where such models can be deployed in practice. Our work provides support for the use of image-based analysis and deep learning in Android malware detection. This attention-based ResNet model will allow us to develop new, more complex security solutions that are better suited for today's ever-changing mobile threat environment.