Conference proceeding
SeqMobile: An Efficient Sequence-Based Malware Detection System Using RNN on Mobile Devices
2020 25th International Conference on Engineering of Complex Computer Systems (ICECCS), pp.63-72
IEEE International Conference on Engineering of Complex Computer Systems-ICECCS
International Conference on Engineering of Complex Computer Systems (ICECCS), 25th (Singapore, 28/10/2020 - 31/10/2020)
2020
Metrics
1 Record Views
Abstract
With the proliferation of Android malware, the demand for an effective and efficient malware detection system is on the rise. The existing device-end learning based solutions tend to extract limited syntax features, such as permissions and API calls, to meet a certain time constraint of mobile devices. However, unlike sequence-based features, syntax features lack the semantics which can represent the potential malicious behaviors and further result in more robust model with high accuracy for malware detection.
In this paper, we propose an efficient Android malware detection system, named SeqMobile, which adopts behavior-based sequence features and leverages customized deep neural networks on mobile devices instead of the server end. Different from the traditional sequence-based approaches on server end, to meet the performance demand on mobile devices, SeqMobile accepts three effective performance optimization methods to reduce the time of feature extraction and prediction. To evaluate the effectiveness and efficiency of our system, we conduct experiments from the following aspects 1) the detection accuracy of different recurrent neural networks (RNN); 2) the feature extraction performance on different mobile devices, and 3) the detection accuracy and prediction time cost of different sequence lengths. The results unveil that SeqMobile can effectively detect malware with high accuracy. Moreover, our performance optimization methods have proven to improve the performance of training and prediction by at least twofold. Additionally, to discover the potential performance optimization from the state-of-the-art TensorFlow model optimization toolkit for our sequence-based approach, we also provide an evaluation on the toolkit, which can serve as a guidance for other systems leveraging on sequence-based learning approach. Overall, we conclude that our sequence-based approach, together with our performance optimization methods, enable us to efficiently detect malware under the performance demands of mobile devices.
Details
- Title
- SeqMobile: An Efficient Sequence-Based Malware Detection System Using RNN on Mobile Devices
- Creators
- Ruitao Feng - Nanyang Technological UniversityJing Qiang Lim - Nanyang Technological UniversitySen Chen - Tianjin UniversityShang-Wei Lin - Nanyang Technological UniversityYang Liu - Nanyang Technological University
- Contributors
- Y Li (Editor)A Liew (Editor)
- Publication Details
- 2020 25th International Conference on Engineering of Complex Computer Systems (ICECCS), pp.63-72
- Conference
- International Conference on Engineering of Complex Computer Systems (ICECCS), 25th (Singapore, 28/10/2020 - 31/10/2020)
- Series
- IEEE International Conference on Engineering of Complex Computer Systems-ICECCS
- Publisher
- IEEE
- Number of pages
- 10
- Grant note
- NSOE003-0001 / Singapore National Research Foundation under NCR; National Research Foundation, Singapore NRF2018 NCR-NCR005-0001 / National Research Foundation, Prime Ministers Office, Singapore under its National Cybersecurity RD Program; National Research Foundation, Singapore 2018T1-002-069 / Singapore Ministry of Education Academic Research Fund Tier 1; Ministry of Education, Singapore 61902395 / National Natural Science Foundation of China; National Natural Science Foundation of China (NSFC) NVIDIA AI Tech Center (NVAITC) NRFI06-20200022 / NRF Investigatorship NRF2018NCRNSOE004-0001 / National Research Foundation, Prime Ministers Office, Singapore under NCR
- Identifiers
- 991013214782902368
- Academic Unit
- Information Technology; Faculty of Science and Engineering
- Language
- English
- Resource Type
- Conference proceeding