Source-linked AI summary
DL-Droid: Deep learning based android malware detection using real devices
Mohammed K. Alzaylaee, Suleiman Y. Yerima, Sakir Sezer
TL;DR
Android malware is increasingly prevalent and sophisticated, challenging traditional detection methods. DL-Droid combines deep learning with stateful dynamic input generation and evaluates it on real devices and over 30,000 applications. The study reports higher performance than traditional classifiers and existing deep-learning frameworks, while emphasizing enhanced input generation.
Problem
Increasing Android malware and improved obfuscation and detection avoidance create a need for more effective zero-day malware detection.
Method
DL-Droid performs dynamic Android malware analysis with deep learning and state-based input generation on real devices, while also supporting stateless Monkey-based input generation for comparison.
Results
DL-Droid achieved better accuracy than existing deep-learning frameworks and traditional classifiers in evaluations using over 30,000 applications.
Takeaways & Limitations
The findings highlight enhanced input generation as significant for machine-learning-based dynamic Android malware detection.
Takeaways & Limitations
Future work could explore self-adaptation to improve the deep-learning system’s performance.
Abstract
from arXiv · showhide
The Android operating system has been the most popular for smartphones and tablets since 2012. This popularity has led to a rapid raise of Android malware in recent years. The sophistication of Android malware obfuscation and detection avoidance methods have significantly improved, making many traditional malware detection methods obsolete. In this paper, we propose DL-Droid, a deep learning system to detect malicious Android applications through dynamic analysis using stateful input generation. Experiments performed with over 30,000 applications (benign and malware) on real devices are presented. Furthermore, experiments were also conducted to compare the detection performance and code coverage of the stateful input generation method with the commonly used stateless approach using the deep learning system. Our study reveals that DL-Droid can achieve up to 97.8% detection rate (with dynamic features only) and 99.6% detection rate (with dynamic + static features) respectively which outperforms traditional machine learning techniques. Furthermore, the results highlight the significance of enhanced input generation for dynamic analysis as DL-Droid with the state-based input generation is shown to outperform the existing state-of-the-art approaches.
1. Introduction
Android malware has grown alongside the platform’s widespread adoption, while increasingly sophisticated evasion methods challenge existing detection systems. DL-Droid addresses this need with deep learning and stateful dynamic input generation, evaluated on real devices.
- Android malware can send premium-rate messages, access private data, install additional malware, and create mobile botnets.
- Over 2.5 million new Android malware apps were discovered in 2017, bringing the number of samples in the wild to almost 25 million.
- Google’s Bouncer and Google Play Protect provide app-scanning defenses, but Bouncer can be evaded and Play Protect failed against malware discovered in the previous 90 days in 2017.
- Additional research is needed to detect zero-day Android malware, particularly because most third-party stores cannot scan submitted harmful applications.
- DL-Droid combines deep learning with stateful input generation and compares this approach with popular machine-learning classifiers using real devices.
- DL-Droid uses state-based input generation for enhanced code coverage and reports higher accuracy than traditional classifiers.
2. Related work
Prior Android malware detectors use static, dynamic, or hybrid analysis, but static methods can be evaded and emulator-based dynamic analysis may be less stable. DL-Droid therefore emphasizes dynamic features extracted on real devices with stateful input generation.
- Static analysis examines disassembled applications using features such as permissions, API calls, commands, and Intents.
- Obfuscation, encryption, update attacks, and polymorphism can hide malicious code from static analysis.
- Dynamic analysis runs applications in controlled environments and monitors behavior, with real phones reported as more stable and feature-rich than emulators.
- Automated dynamic analysis requires generated touches, gestures, or clicks to increase code coverage and trigger malicious behaviors.
- Existing deep-learning systems reported 93.68% accuracy for Deep4MalDroid and 95.98% for AutoDroid in their evaluated settings.
- DL-Droid differs through stateful input generation, real-device analysis, 420 static and dynamic features, and evaluation on over 30,000 applications.
- Real-device feature extraction avoids emulator-targeted evasion and helps address static-analysis limitations such as dynamic code loading, obfuscation, and encryption.
3. Methodology and experiments
DL-Droid evaluates deep-learning malware detection through automated dynamic analysis on real phones, comparing stateful DroidBot input generation with stateless Monkey generation across large-scale experiments.
- Experimental setup: DL-Droid uses DynaLog to run Android applications automatically on real phones, extract features, and generate stateful or stateless test inputs.DynaLog supports DroidBot stateful generation and Monkey stateless generation for dynamic analysis.
- Input generation: Stateful input generation selects events from the current user-interface state, whereas Monkey produces pseudo-random event streams controlled by a seed.The stateful approach was used as DL-Droid’s default, with stateless generation serving as the comparative baseline.
- Input generation: 180 s was sufficient for stateful generation, while 300 s generated 4,000 Monkey events for the stateless experiments.Beyond 4,000 events, most applications produced no further dynamic output from DynaLog.
- Experimental setup: 31,125 applications were evaluated, including 11,505 malware samples and 19,620 internally vetted benign samples.The dataset included paid, utility, banking, media-player, and game applications.
- Features extraction and preprocessing: The experiments used 420 features, combining dynamically extracted API calls and intents with statically extracted Android permissions.The original 178 dynamic features were ranked and reduced to 120, while permissions expanded the total to 420 features.
- Features ranking comparisons: Stateful generation produced higher InfoGain scores for selected telephony and SMS-related features than stateless Monkey generation.For example, getDeviceId scored 0.099 with DroidBot versus 0.075 with Monkey, while getSubscriberId scored 0.057 versus 0.042.
4. Experimental results and discussions
DL-Droid achieved its strongest results with stateful input generation, dynamic features, and added permissions, outperforming the compared machine-learning approaches. The experiments also show that stateful input generation generally improves detection performance over stateless generation.
- Dynamic features: stateful input generation: 0.963 w-FM was achieved with three hidden layers of 200 neurons each using stateful input generation and dynamic features only.This configuration had a running time of nine minutes.
- Dynamic features: stateless input generation: 0.958 w-FM was achieved with stateless Monkey-based input generation using three layers with 300, 100, and 300 neurons.The stateless configuration ran in eight minutes, but the comparison focused on detection accuracy.
- Static and dynamic features: Nearly 0.99 w-FM was reached when static permissions were combined with dynamic features under stateful input generation.Three hidden layers with 200 neurons each performed best among the tested deep networks.
- Comparison with machine-learning classifiers: 0.963 w-FM with dynamic features exceeded Random Forest’s 0.94, while nearly 0.99 w-FM with permissions exceeded Random Forest’s 0.97.These comparisons used the results in Tables 10 and 11.
- Stateful versus stateless input generation: Stateful Droidbot input generation generally outperformed stateless Monkey input generation, especially when static and dynamic features were combined.With dynamic features only, NB and J48 were exceptions; with combined features, stateful generation was superior for all classifiers.
- Comparison with prior deep-learning methods: DL-Droid achieved 98.5% accuracy and outperformed DroidDetector in all other reported metrics while using more samples.The comparison was against other deep-learning-based Android malware detection methods.
5. Conclusion
DL-Droid is presented as an automated deep-learning framework for Android malware detection, evaluated across multiple feature configurations and compared with traditional and existing deep-learning approaches. The results support real-device dynamic analysis and enhanced input generation as important elements of the system.
- Evaluation: DL-Droid evaluates Android malware detection on 31,125 applications using 420 static and dynamic features.The evaluation compares traditional machine-learning classifiers and existing deep-learning frameworks.
- Framework: DL-Droid uses state-based input generation by default while also supporting the stateless Monkey approach.The framework is designed for automated dynamic analysis of Android applications.
- Experimental configurations: The evaluation includes separate deep-learning experiments with stateless input generation using dynamic-only and static-plus-dynamic feature combinations.These configurations are reported in Tables 8 and 9.
- Comparative results: The reported comparisons include stateful dynamic-only and static-plus-dynamic feature settings, as well as comparisons with existing deep-learning approaches.Tables 10–12 organize these result comparisons.
- Findings: The authors report higher accuracy figures than existing deep-learning Android malware frameworks and identify enhanced input generation as significant for machine-learning-based dynamic analysis.They describe this as the first investigation of deep learning using dynamic features extracted from applications on real phones.
- Future work: Self-adaptation is proposed as future work for potentially improving the deep-learning system’s Android malware-detection performance.The proposal is motivated by recent work on self-adaptation for intrusion-detection systems.