Towards Accurate Labeling of Android Apps for Reliable Malware Detection
Towards Accurate Labeling of Android Apps for Reliable Malware Detection
复制标题
DOI：
10.1145/3422337.3447849
复制
发表时间：
2020-07
期刊：
影响因子：
--
通讯作者：
Aleieldin Salem
中科院分区：
文献类型：
--
作者：
Aleieldin Salem
在训练他们新开发的恶意软件检测方法时，研究人员依靠基于阈值的标签策略来解释在线平台（如VirusTotal）提供的扫描报告。该平台的动态性使得这些标签策略在长时间内不可持续，从而导致标签不准确。使用标签不准确的应用程序来训练和评估恶意软件检测方法，大大破坏了其结果的可靠性，导致要么放弃其他有希望的检测方法，要么采用本质上不充分的方法。通过手工分析生成准确标签的不可行性，以及缺乏可靠的替代方案，迫使研究人员使用VirusTotal来标记应用程序。在本文中，我们以两种方式来解决这个问题。首先，我们揭示了VirusTotal动态的各个方面以及它们如何影响基于阈值的标记策略，并就如何在VirusTotal动态的情况下可靠地使用这些标记策略提供了可操作的见解。其次，我们通过(a)确定此类平台应避免的VirusTotal限制，以及(b)提出如何构建此类平台以减轻VirusTotal限制的架构来激励替代平台的实施。
In training their newly-developed malware detection methods, researchers rely on threshold-based labeling strategies that interpret the scan reports provided by online platforms, such as VirusTotal. The dynamicity of this platform renders those labeling strategies unsustainable over prolonged periods, which leads to inaccurate labels. Using inaccurately labeled apps to train and evaluate malware detection methods significantly undermines the reliability of their results, leading to either dismissing otherwise promising detection approaches or adopting intrinsically inadequate ones. The infeasibility of generating accurate labels via manual analysis and the lack of reliable alternatives force researchers to utilize VirusTotal to label apps. In the paper, we tackle this issue in two manners. Firstly, we reveal the aspects of VirusTotalss dynamicity and how they impact threshold-based labeling strategies and provide actionable insights on how to use these labeling strategies given VirusTotal's dynamicity reliably. Secondly, we motivate the implementation of alternative platforms by (a) identifying VirusTotal limitations that such platforms should avoid, and (b) proposing an architecture of how such platforms can be constructed to mitigate VirusTotal's limitations.