Analysis of Dataset Shifts in Mobile Malware

在过去的十年里，智能手机和平板电脑等移动设备的受欢迎程度显著上升。不幸的是，它们的流行也使它们成为恶意软件作者的有利可图的目标，使得这些设备往往没有受到保护，因为反病毒供应商并不总是能及时提供其产品的更新。为了弥补当前反病毒扫描程序的弱点，研究人员提出了基于机器学习的各种检测移动恶意软件的方法。事实证明，这些方法能够得出有效的模式来自动检测恶意软件。然而，最近的研究表明，这些方法的检测性能随着时间的推移而下降，这一现象在机器学习理论中被称为“数据集漂移”。例如，尽管混淆技术在移动应用中的使用越来越多地解释了这些观察结果的一部分，但这一领域中数据集移动的原因大多仍不清楚。在这个项目中，我们的目标是全面了解数据集移动背后的原因，以及如何减轻其对基于学习的移动恶意软件检测系统检测性能的影响。为此，我们的研究沿着以下两个步骤进行：第一步，我们通过采用解释机器学习模型的方法来分析现有方法随时间的检测能力。通过这种方式，我们试图识别阻碍移动恶意软件检测的因素，并对数据集迁移的出现承担主要责任。在第二步中，我们利用不同的特征空间来开发合适的方法来检测随时间推移的移动恶意软件。

The popularity of mobile devices, such as smartphones and tablets, hasgrown significantly in the past decade. Unfortunately, theirpopularity has also made them a profitable target for malware authors,leaving these devices often unprotected, as anti-virus vendors cannotalways provide updates for their products on time.To compensate for the weaknesses of current anti-virus scanners,researchers have proposed various methods for the detection of mobilemalware based on machine learning. These approaches have proven to becapable of deriving effective patterns to detect malwareautomatically. Most recently, however, it has been shown that thedetection performance of these methods decreases over time, aphenomenon referred to as "dataset shift" in machine learningtheory. While, for instance, the growing use of obfuscation techniquesin mobile applications explains parts of these observations, thecauses for dataset shift in this domain are mostly still unknown.In this project, we aim to gather a comprehensive understanding of thereasons behind dataset shift and how to alleviate its impact on thedetection performance of learning-based systems for mobile malwaredetection. To this end, we guide our research along the following twosteps: In the first step, we analyze the detection capabilities ofexisting approaches over time by adapting methods for interpretingmachine learning models. This way, we attempt to identify factors thatimpede the detection of mobile malware and are primarily responsiblefor the emergence of dataset shift. In the second step, we exploredifferent feature spaces to develop suitable methods for detectingmobile malware over time.