PaperlayerView exact revision on arXiv

Source-linked AI summary

R2-D2: ColoR-inspired Convolutional NeuRal Network (CNN)-based AndroiD Malware Detections

TonTon Hsien-De Huang, Hung-Yu Kao

arXiv:1705.04448v5cs.CRcs.AI

TL;DR

Android malware is rapidly changing, while conventional detection depends on pre-extracted features and can be challenged by obfuscation and encryption. R2-D2 converts classes.dex bytecode into RGB color images and applies CNN-based automatic feature extraction; experiments report high accuracy and detection of unknown malware, while identifying image-transformation limitations.

  • Problem

    Rapidly iterating Android malware and anti-analysis techniques challenge detection methods that depend on continuous feature engineering or reverse-engineered representations.

  • Method

    R2-D2 decompresses APKs, maps hexadecimal classes.dex bytecode to RGB color codes, forms Android color images, and applies CNN-based learning.

  • Results

    R2-D2 achieved 98.4225% and 97.7081% accuracy in optimization experiments and detected more than 75% of evaluated Minecraft malware apps.

  • Takeaways & Limitations

    The authors report that R2-D2 detects known and unknown Android malware while reducing reliance on manual feature extraction and supporting deployment in products and mobile devices.

  • Takeaways & Limitations

    Transforming bytecode into images can create artificial local correlations, while pooling can destroy code contexts and semantics, reducing detection accuracy.

Abstract

from arXiv · show

The influence of Deep Learning on image identification and natural language processing has attracted enormous attention globally. The convolution neural network that can learn without prior extraction of features fits well in response to the rapid iteration of Android malware. The traditional solution for detecting Android malware requires continuous learning through pre-extracted features to maintain high performance of identifying the malware. In order to reduce the manpower of feature engineering prior to the condition of not to extract pre-selected features, we have developed a coloR-inspired convolutional neuRal networks (CNN)-based AndroiD malware Detection (R2-D2) system. The system can convert the bytecode of classes.dex from Android archive file to rgb color code and store it as a color image with fixed size. The color image is input to the convolutional neural network for automatic feature extraction and training. The data was collected from Jan. 2017 to Aug 2017. During the period of time, we have collected approximately 2 million of benign and malicious Android apps for our experiments with the help from our research partner Leopard Mobile Inc. Our experiment results demonstrate that the proposed system has accurate security analysis on contracts. Furthermore, we keep our research results and experiment materials on http://R2D2.TWMAN.ORG.

I. INTRODUCTION

Android’s widespread adoption and openness have enabled substantial malware growth, while evolving obfuscation and encryption weaken conventional detection approaches. The paper motivates automated analysis that can handle rapidly changing Android malware without extensive manual feature engineering.

  • Threat landscape: Android held approximately 85% of the smartphone market in 2017 Q1, increasing the potential reach of Android malware.The paper links Android’s popularity and openness to attackers’ attention and malware distribution.
  • Threat landscape: More than 50,000 users were infected daily in the United States, United Kingdom, and France in January 2017.These statistics came from the authors’ back-end system.
  • Threat landscape: Android malware grew from 1 million samples in 2012 to more than 17 million in 2016, with over 10 million found in the first half of 2017.The reported counts illustrate the rapid expansion of the malware population.
  • Android application structure: An Android APK packages application components including AndroidManifest.xml, resources, libraries, and classes.dex containing Dalvik bytecode.The compilation process transforms Java source into .class files, then .dex files, which are packaged into an APK.
  • Existing analysis methods: Static and dynamic analysis rely on reverse engineering, behavior monitoring, or manually generated signatures that malware changes can evade.The paper describes obfuscation, encryption, anti-debugging, and component modification as evasion techniques.

B. Machine Learning-based Malware Detection

Machine-learning Android malware detection commonly uses manually engineered permissions, API, and control-flow features, but unknown malware and obfuscation remain difficult to detect.

  • Machine-learning detectors commonly use Android permissions, API invocations, and control-flow graphs to distinguish benign from malicious apps.
  • Behavior-based approaches track system communications, network connections, or messages by emulating apps in sandboxes or virtual machines.
  • Existing detection models usually cannot successfully identify zero-day exploit malware by correlating API invocations with Android permissions.

C. Deep Learning

Deep-learning malware detectors still commonly depend on feature engineering and relatively small datasets, limiting their representation of evolving malware and increasing computational demands.

  • Deep learning uses multiple interconnected neural-network layers to learn hidden relationships between inputs and outputs through learned representations.
  • CNNs combine hidden, fully connected, convolutional, and pooling layers for image-based representation learning.
  • Prior malware studies feed engineered inputs—including API identifiers, contextual byte features, permissions, and dynamic actions—into deep architectures.
  • Despite deep learning, existing methods still require feature engineering, while small training datasets may not reflect real-world malware accurately.
  • N-gram detection can achieve accuracy but consumes substantial computing resources and time as model parameters grow.
  • A CNN method using one-hot opcode vectors still requires reverse engineering and therefore cannot handle malware with encryption.

III. OUR PROPOSED MECHANISM: R2-D2

R2-D2 converts Android classes.dex bytecode into RGB color images and applies CNN-based end-to-end learning without manually extracting features. The design targets rapidly evolving and previously unknown malware while reducing processing overhead.

  • A. The Characteristic of Our Methodology: R2-D2 addresses unknown Android samples that current static and dynamic methods may fail to detect amid rapid malware iteration and reverse-engineering techniques.
  • A. The Characteristic of Our Methodology: Dalvik bytecode records opcode sequences and API operations that can reveal behaviors such as device-model detection and APK installation.
  • A. The Characteristic of Our Methodology: R2-D2 decompresses APKs, translates classes.dex hexadecimal bytecode into RGB color images, and applies CNNs to detect malware.
  • A. The Characteristic of Our Methodology: The system performs end-to-end training from Android color images without manually extracting app features in advance.
  • A. The Characteristic of Our Methodology: Classes.dex-to-RGB translation completes within 0.4 second and preserves more information using 16777216 colors than grayscale’s 256 colors.
  • A. The Characteristic of Our Methodology: CNN local receptive fields and shared weights reduce parameter counts while representing complex Android-malware structure.
  • A. The Characteristic of Our Methodology: Using only classes.dex produces images of about 10–50kb, which can reduce user-side traffic and processing resources compared with uploading full apps for analysis.

B. The Core Technology of Our Methodology

R2-D2 converts Android classes.dex bytecode into color images for CNN-based analysis, while addressing representation, pooling, and deployment limitations identified for Android malware detection.

  • Color-image representation: R2-D2 decompresses Android apps, retrieves classes.dex bytecode, and maps it into Android color images for CNN classification.The method uses malware-family categories from a partner detection system as part of its collected data.
  • Color-image representation: Samples from the same Android malware family exhibit similar visual patterns under image-distance measures, supporting color-image-based classification.The reported examples show 54.59% and 54.94% similarity, although the paper says fine-grained similarity is not accurate.
  • Method limitations: Bytecode-to-image conversion may correlate originally unrelated bytecode, allowing malware to exploit a mismatch with conventional CNN filter sizes.The paper identifies this representation mismatch as one possible evasion route.
  • Method limitations: Pooling can destroy code contexts and semantics because Android color images are formed from source code rather than natural images, causing detection inaccuracy.Pooling is used to reduce computation overhead in conventional image recognition, but the paper identifies that benefit as problematic here.
  • Method limitations: The CNN trained model is too large to embed directly in an Android app for malware detection.The architecture therefore relies on a deployment arrangement that keeps the model off the user device.

C. The Architecture of Our Methodology

The R2-D2 architecture scans Android apps locally, sends unknown apps as color images to a backend GPU pool, and returns Inception-v3 identification results to the user.

  • User-side workflow: Known apps return scan results directly, while unknown apps proceed through the backend analysis pipeline.The architecture distinguishes already identified apps from unknown apps before transformation and upload.
  • Backend processing: Unknown apps are transformed from classes.dex into Android color images and uploaded to the backend.This image representation is the input to subsequent server-side analysis.
  • Backend processing: The backend feeds Android color images to a TensorFlow GPU computing pool and identifies apps with a trained Inception-v3 model.The pipeline uses GPU-backed TensorFlow computation rather than embedding the large model on the phone.
  • User-side workflow: Identification results are sent back to the user’s phone after backend processing.The architecture separates mobile scanning from model inference and result delivery.

A. Experiment Environment and Datasets

Experiments used a large Android-app collection and compared CNN architectures and optimizers under a fixed learning rate to evaluate detection accuracy and performance.

  • Experiment environment: The experimental environment used Ubuntu 14.04 with 128 GB RAM, Intel Xeon E5-2620 v4 CPU, and NVIDIA TITAN V, TITAN XP, and GTX 1080 GPUs.The software environment used nvidia-docker with TensorFlow 18.04-py2 on NVIDIA cloud.
  • Datasets: Approximately 2 million benign and malicious Android apps were collected from January 2017 to August 2017.The data came from research partner Leopard Mobile Inc.
  • Evaluation setup: The study evaluated AlexNet, GoogLeNet, and Inception-v3 with SGD, NAG, AdaDelta, and AdaGrad optimization methods.The learning rate was fixed at 0.01.
  • Evaluation setup: Inception-v3 was almost always better than AlexNet and other models, while SGD was found most suitable among the compared optimizers.The paper reports that SGD produced the sharpest increase in accuracy and sharpest decrease in loss.
  • Results: 98.4225% and 97.7081% accuracy were achieved in the reported experiments.The passage reports both values without assigning each to a separate model or condition.

C. Validation on Real Environment

Real-environment validation assessed unknown-app detection using benign and malicious samples and compared R2-D2 with VirusTotal vendors and antivirus engines.

  • Validation data: The validation dataset included apps from multiple categories and countries, plus benign samples with no malicious VirusTotal reports and malicious samples from Contagio.The evaluation was designed to assess detection of unknown malware collected from Google Play.
  • Evaluation metrics: The evaluation measured TP, FP, FN, TN, accuracy, precision, recall, false-positive rate, and F1-score.These metrics were used for the R2-D2 detection evaluation.
  • Real case study: R2-D2 was compared with VirusTotal and antivirus engines using 87 ESET-verified Minecraft malware apps from Google Play.The apps had exceeded 1 million installations and used deceptive advertisements and Device Administrator permission.
  • Real case study: More than 75% of the Minecraft malware apps were detected by R2-D2, compared with approximately 16% of vendors on 2017/03/24 and approximately 32% on 2017/03/30.The comparison concerns detection coverage reported for the evaluated malware apps.

E. Comparison with Existing Methodology

R2-D2 is compared with existing Android malware detectors using detection quality, dataset size, and speed. Although it is slightly weaker on some detection metrics, its larger training set, fast inference, and automated image conversion are emphasized.

  • Comparison with Existing Methodology: R2-D2 is slightly weaker than some existing methods in DR/FPR and accuracy, which the authors attribute to differences in dataset size and representativeness.The comparison notes that competing approaches use smaller datasets and do not provide their data sources.
  • Comparison with Existing Methodology: 0.5 seconds is the reported detection time for each incoming sample.
  • Comparison with Existing Methodology: 0.4 seconds is required to transform an Android app into a color image, without manual feature-extraction engineering.
  • Large Scale Ransomware Detection with Naked Eye: 91.72% true positive was achieved on 20,035 malicious samples collected in September 2017.
  • Large Scale Ransomware Detection with Naked Eye: 8.85% false positive was observed on 20,313 benign samples collected in September 2017.
  • Large Scale Ransomware Detection with Naked Eye: 96.88% true positive was reported for 5,852 ransomware samples, whose family-level visual patterns also supported rapid categorization.

G. Hunting the Ethereum Smart Contract

The paper extends its bytecode-to-image CNN approach to Ethereum smart-contract vulnerability detection. It reports that smart-contract scanning can achieve a score above 0.90.

  • Hunting the Ethereum Smart Contract: Ethereum smart contracts are presented as an important security target because vulnerabilities can be publicly visible yet not immediately stoppable.
  • Hunting the Ethereum Smart Contract: Solidity bytecode is translated into RGB color codes, transformed into fixed-sized images, and fed to a CNN for vulnerability detection.
  • Hunting the Ethereum Smart Contract: 0.90+ is the reported performance level for the smart-contract scan.
Loading 1705.04448v5…