Analysis of Dataset Shifts in Mobile Malware

移动的设备（诸如智能手机和平板电脑）的普及在过去十年中显著增长。不幸的是，它们的流行也使它们成为恶意软件作者的有利可图的目标，使这些设备通常不受保护，因为反病毒供应商不能总是及时为他们的产品提供更新。为了弥补当前反病毒扫描程序的弱点，研究人员提出了各种基于机器学习的移动的恶意软件检测方法。这些方法已被证明能够获得有效的模式来自动检测恶意软件。然而，最近的研究表明，这些方法的检测性能会随着时间的推移而下降，这种现象在机器学习理论中被称为“数据集偏移”。虽然，例如，在移动的应用程序中越来越多地使用混淆技术解释了这些观察结果的一部分，在这个领域中的数据集转移的原因大多仍然是未知的。在这个项目中，我们的目标是收集一个全面的理解数据集转移背后的原因，以及如何减轻其对基于学习的系统的检测性能的影响移动的恶意软件检测。为此，我们引导我们的研究沿着以下两个步骤：在第一步中，我们通过调整解释机器学习模型的方法来分析现有方法随着时间的推移的检测能力。通过这种方式，我们试图确定阻碍移动的恶意软件检测的因素，并主要负责数据集转移的出现。在第二步中，我们探索不同的特征空间，以开发合适的方法来检测移动的恶意软件随着时间的推移。

The popularity of mobile devices, such as smartphones and tablets, has grown significantly in the past decade. Unfortunately, theirpopularity has also made them a profitable target for malware authors, leaving these devices often unprotected, as anti-virus vendors cannot always provide updates for their products on time.To compensate for the weaknesses of current anti-virus scanners, researchers have proposed various methods for the detection of mobile malware based on machine learning. These approaches have proven to be capable of deriving effective patterns to detect malware automatically. Most recently, however, it has been shown that the detection performance of these methods decreases over time, a phenomenon referred to as "dataset shift" in machine learning theory. While, for instance, the growing use of obfuscation techniques in mobile applications explains parts of these observations, the causes for dataset shift in this domain are mostly still unknown.In this project, we aim to gather a comprehensive understanding of the reasons behind dataset shift and how to alleviate its impact on the detection performance of learning-based systems for mobile malware detection. To this end, we guide our research along the following two steps: In the first step, we analyze the detection capabilities of existing approaches over time by adapting methods for interpreting machine learning models. This way, we attempt to identify factors that impede the detection of mobile malware and are primarily responsible for the emergence of dataset shift. In the second step, we explore different feature spaces to develop suitable methods for detecting mobile malware over time.