Graph Embedding Based Familial Analysis of Android Malware using Unsupervised Learning
Graph Embedding Based Familial Analysis of Android Malware using Unsupervised Learning
复制标题
DOI：
10.1109/icse.2019.00085
复制
发表时间：
2019-05
期刊：
影响因子：
--
通讯作者：
Ming Fan;Xiapu Luo;Jun Liu;Meng Wang;Chunyin Nong;Q. Zheng;Ting Liu
中科院分区：
文献类型：
--
作者：
Ming Fan;Xiapu Luo;Jun Liu;Meng Wang;Chunyin Nong;Q. Zheng;Ting Liu
Android恶意软件的快速增长给智能手机用户带来了严重的安全威胁。基于先前工作观察到的Android恶意软件的家族特征，家族分析是一种很有前途的方法，可以帮助分析人员更好地关注同一家族中恶意软件样本的共性，从而减少分析工作量并加速恶意软件分析。大多数现有方法依赖于监督学习，并面临三个主要挑战，即，准确率低，效率低，缺乏标记数据集。为了解决这些问题，我们首先构建了一个细粒度的行为模型抽象成一组子图的程序语义。然后，我们提出了SRA，一个新的功能，描述了敏感的API调用节点的子图中的结构角色之间的相似性关系。基于图嵌入技术得到一个SRA，并将其表示为一个向量，从而有效地降低了图匹配的高复杂度。之后，我们不是用标记的样本训练分类器，而是基于SRA构建恶意软件链接网络，并在其上应用社区检测算法将未标记的样本分组。我们在一个名为GefDroid的系统中实现了这些想法，该系统使用无监督学习对Android恶意软件进行基于图嵌入的家族分析。此外，我们进行了广泛的实验，以评估GefDroid在三个数据集与地面真相。结果表明，GefDroid的聚类结果与地面事实之间可以达到高度一致（NMI为0.707-0.883）。此外，GefDroid只需要线性的运行时开销，平均大约需要8.6秒来分析一个样本，这比以前的工作快得多。
The rapid growth of Android malware has posed severe security threats to smartphone users. On the basis of the familial trait of Android malware observed by previous work, the familial analysis is a promising way to help analysts better focus on the commonalities of malware samples within the same families, thus reducing the analytical workload and accelerating malware analysis. The majority of existing approaches rely on supervised learning and face three main challenges, i.e., low accuracy, low efficiency, and the lack of labeled dataset. To address these challenges, we first construct a fine-grained behavior model by abstracting the program semantics into a set of subgraphs. Then, we propose SRA, a novel feature that depicts the similarity relationships between the Structural Roles of sensitive API call nodes in subgraphs. An SRA is obtained based on graph embedding techniques and represented as a vector, thus we can effectively reduce the high complexity of graph matching. After that, instead of training a classifier with labeled samples, we construct malware link network based on SRAs and apply community detection algorithms on it to group the unlabeled samples into groups. We implement these ideas in a system called GefDroid that performs Graph embedding based familial analysis of AnDroid malware using unsupervised learning. Moreover, we conduct extensive experiments to evaluate GefDroid on three datasets with ground truth. The results show that GefDroid can achieve high agreements (0.707-0.883 in term of NMI) between the clustering results and the ground truth. Furthermore, GefDroid requires only linear run-time overhead and takes around 8.6s to analyze a sample on average, which is considerably faster than the previous work.