PaperlayerView exact revision on arXiv

Source-linked AI summary

A Performance-Sensitive Malware Detection System Using Deep Learning on Mobile Devices

Ruitao Feng, Sen Chen, Xiaofei Xie, Guozhu Meng, Shang-Wei Lin, Yang Liu

arXiv:2005.04970v3cs.CRcs.SE

TL;DR

Server-side Android malware detection can be slow for apps from unofficial sources, and upload transfer creates security concerns. MobiTive adapts feature extraction and deep-learning models for mobile deployment; comparisons report higher accuracy and faster feature extraction than two prior approaches.

  • Problem

    Server-side Android malware detection can delay scanning apps from unofficial sources, while uploading apps for detection adds transmission overhead and security risks.

    Source: §I · p. 1

  • Method

    MobiTive extracts manifest properties and API calls from binary code, updates its feature dictionary, and migrates and quantizes customized deep-learning models for on-device prediction.

    Source: §I · p. 2, A. Overview of MobiTive · p. 4

  • Results

    96.75% accuracy versus 94.79% for McLaughlin et al. and 96.25% for MalDozer, with 0.051-second extraction versus 5.065 and 3.515 seconds on PC.

    Source: 4) Comparison between the existing… · p. 9

  • Takeaways & Limitations

    Evaluation on six real devices supports reliable, responsive detection directly on phones, averaging less than 3 seconds per app.

    Source: §VII · p. 15

    The selected feature set may miss a new malware family if its behaviors are not represented by manifest properties or API calls.

    Source: §V · p. 13

Abstract

from arXiv · show

Currently, Android malware detection is mostly performed on server side against the increasing number of malware. Powerful computing resource provides more exhaustive protection for app markets than maintaining detection by a single user. However, apart from the applications provided by the official market, apps from unofficial markets and third-party resources are always causing serious security threats to end-users. Meanwhile, it is a time-consuming task if the app is downloaded first and then uploaded to the server side for detection, because the network transmission has a lot of overhead. In addition, the uploading process also suffers from the security threats of attackers. Consequently, a last line of defense on mobile devices is necessary and much-needed. In this paper, we propose an effective Android malware detection system, MobiTive, leveraging customized deep neural networks to provide a real-time and responsive detection environment on mobile devices. MobiTive is a preinstalled solution rather than an app scanning and monitoring engine using after installation, which is more practical and secure. Original deep learning models cannot be directly deployed and executed on mobile devices due to various performance limitations, such as computation power, memory size, and energy. Therefore, we evaluate and investigate the following key points:(1) the performance of different feature extraction methods based on source code or binary code;(2) the performance of different feature type selections for deep learning on mobile devices;(3) the detection accuracy of different deep neural networks on mobile devices;(4) the real-time detection performance and accuracy on different mobile devices;(5) the potential based on the evolution trend of mobile devices' specifications; and finally we further propose a practical solution (MobiTive) to detect Android malware on mobile devices.

I. INTRODUCTION

Android malware threatens users, while server-side detection can delay protection and expose apps to insecure uploads. MobiTive combines binary-code features with customized neural networks for device-end detection, evaluating accuracy, extraction cost, and performance across devices.

I. INTRODUCTION

  • Server-side detection can delay scanning large apps and expose uploads to tampering, motivating a last line of defense directly on mobile devices.The introduction describes unofficial-market and third-party apps as particularly unpredictable and vulnerable.Source: §I · p. 1
  • MobiTive achieved 96.78% accuracy on real testing data in the wild, with average detection overhead below 3 seconds per app.The introduction reports both outcomes as results of the comprehensive experiments.Source: §I · p. 2
  • The study compares feature extraction methods and types, seven neural networks, four existing detection approaches, and runtime performance across six real devices.It also evaluates multi-class classification and mobile-device specification trends.Source: §I · p. 2
  • MobiTive is a preinstalled, device-end solution using customized deep neural networks and binary features rather than server detection or post-installation monitoring.The system proposes binary-code feature extraction and feature updating based on malicious behaviors.Source: §I · p. 2

II. PRELIMINARIES

The preliminaries describe Android app and Dalvik structures, then review market, device, and operating-system security mechanisms. These foundations frame the later deployment of detection models on resource-constrained phones.

II. PRELIMINARIES

  • The section introduces app structure, Dalvik executables, security mechanisms, and model migration and quantization as preliminaries for the system.The stated scope also includes migrating trained deep-learning models from PC or server environments.Source: §II · p. 2

A. Android Apps

  • An APK packages an Android app and contains a manifest, Dex files, resources, and assets.The manifest records app metadata, components, permissions, and device compatibility; Dex contains executable code and is often decompiled into smali for analysis.Source: A. Android Apps · p. 3

B. Dalvik Executable

  • Dalvik executable files contain metadata and program information whose offsets map static data, allowing access without decompiling the binary.The file also contains compiled code, accessible using each method's offset.Source: B. Dalvik Executable · p. 3

C. Security Mechanisms

  • Android security spans app markets, the OS, and device-end protections, but third-party market checks may be limited and bypassable.Device antivirus tools monitor sensitive components or scan signatures, while Android's sandbox isolates app execution and limits access to unrequested components.Source: C. Security Mechanisms · p. 3

D. Deep Learning Model Migration and Quantization

Because mobile devices constrain computation, memory, and energy, MobiTive adapts trained models for deployment. Its pipeline prepares and trains models server-side, migrates and quantizes them, then extracts app features and predicts on-device.

D. Deep Learning Model Migration and Quantization

  • Mobile devices' limited computation, memory, and energy make direct deployment of computationally intensive deep-learning models difficult.Quantization reduces model precision to improve computation efficiency and reduce memory and storage requirements.Source: D. Deep Learning Model Migration and… · p. 3

A. Overview of MobiTive

  • MobiTive separates server-side feature preparation and model training from mobile-side deployment using migrated and quantized models.The model is migrated to TensorFlow Lite, and quantization is used as a mobile performance optimization with little accuracy degradation stated as its general purpose.Source: A. Overview of MobiTive · pp. 3–4
  • The server-side pipeline extracts and vectorizes manifest properties and API calls from binary code, selects and updates the feature dictionary, and trains a customized neural network.The trained model and dictionary are prepared for deployment on mobile devices.Source: A. Overview of MobiTive · p. 4
  • On-device, MobiTive loads the model and feature dictionary, extracts vectors from downloaded apps, and predicts whether each app is malware with a confidence level.The described flow covers apps downloaded from either a market or a third-party market.Source: A. Overview of MobiTive · p. 4

B. Feature Preparation

MobiTive selects features for mobile extraction efficiency, expands its dictionary using mined malicious behaviors, and extracts feature vectors directly from APK binary contents rather than decompiled source code.

1) Feature Selection:

  • Manifest properties and API calls are selected for the device-end scenario after comparing extraction performance across candidate feature types and steps.The paper also evaluates ICFG and call graphs; it chooses unzipping APKs for raw-data extraction and these two feature categories for the device-end system.Source: 1) Feature Selection · p. 4, B. Feature Preparation · p. 4
  • The initial dictionary contains 613 manifest properties and 1,509 selected API calls, pruned from 2,989,011 unique calls parsed from over 60,000 apps.The pruning removes obfuscated calls, calls unrelated to potential malicious behavior, and third-party calls.Source: 1) Feature Selection · pp. 4–5

2) Feature Updating:

  • Behavior mining from hundreds of industrial malware reports identifies 23 potential malicious behaviors and adds 46 API calls and 12 manifest properties.Package-based expansion extends those API calls by 781, yielding an updated dictionary of 2,290 API calls and 625 manifest properties.Source: 2) Feature Updating · p. 5

3) Feature Vector Extraction:

  • The feature-vector extraction method parses API calls from the API table in Dalvik binary files and decodes the binary manifest, avoiding source-code decompilation.The API table maps executable symbols to API strings using metadata addresses and offsets; decoded manifest data supplies manifest properties.Source: 3) Feature Vector Extraction · p. 5

C. DL Model Construction

MobiTive trains customized deep neural networks, migrates and quantizes the model for mobile deployment, and uses it to classify APKs from prepared features on-device.

1) DL Model Training:

  • Seven neural networks are trained; customized RNN variants use 128-unit LSTM/GRU layers and dropout, while the CNN uses convolution, global max pooling, and dense classification.Simple RNNs use a dropout rate of 0.5; stacked and bidirectional variants modify the recurrent layers.Source: 1) DL Model Training · p. 5

2) DL Model Migration and Quantization:

  • TensorFlow models are converted to TensorFlow Lite and quantized for mobile deployment, with experiments measuring the effects on accuracy and time cost.The paper says quantization improves mobile performance without much effect on detection accuracy.Source: 2) DL Model Migration and Quantization · p. 6

D. Real-Time Detection System

  • For each APK, MobiTive extracts manifest properties and API calls, joins their vectors, predicts with the deployed model, and returns a result that can warn users and block installation.New server-trained models can be delivered to devices as system patches.Source: D. Real-Time Detection System · p. 6

IV. EXPERIMENTS

The experiments assess extraction speed and detection performance on server and mobile platforms. Feature-extraction tests compare source-code and binary-code methods, while broader evaluations cover model accuracy and device usability.

IV. EXPERIMENTS

  • Experiments assess extraction cost, feature updating, network accuracy, comparisons with existing detectors, malware-family classification, and mobile usability across six devices.The mobile evaluations also compare MobiTive’s efficiency with dynamic behavior-based detection and examine hardware trends.Source: §IV · p. 6

A. Experiment Environment

  • The evaluation uses six Android devices: four common-specification phones, one flagship, and one low-profile phone, alongside a server setup.The devices include models from Google, Huawei, HTC, LG, and Samsung.Source: A. Experiment Environment · pp. 6–7

1) Performance evaluation of feature extraction:

  • 0.037 seconds for 5MB apps and 0.594 seconds for 50MB apps were required to unzip raw data, substantially less time than decompilation; ICFG and CG extraction were judged too slow.The comparison covers ICFG extraction with FlowDroid and CG generation with Soot or AndroGuard.Source: 1) Performance evaluation of feature… · p. 7, Figure 2 · p. 7
  • At 5MB, API extraction took 0.042 seconds from binary versus 2.923 seconds from smali; manifest properties and API calls were selected over slower opcode sequences.Opcode-sequence extraction exceeded 6 seconds on average for 50MB apps.Source: 1) Performance evaluation of feature… · pp. 7–8, Figure 3 · p. 8

2) Accuracy evaluation of behavior-based feature updating method:

Behavior-based feature updating improves reported accuracy for CNN, LSTM, and GRU models. The evaluation uses a balanced sample drawn from a larger collection of benign and malicious apps.

2) Accuracy evaluation of behavior-based feature updating method:

  • From more than 70,000 collected apps, the authors selected 18,000 malware and 18,000 benign apps, splitting data into 80% training and equal validation and test portions of the remainder.The malware collection combines several sources; duplicates and failed or broken APK cases were removed.Source: 2) Accuracy evaluation of… · p. 8
  • The updated feature set contains 2,290 API calls and 625 manifest properties, compared with 1,509 API calls and 613 manifest properties for MobiDroid.CNN, LSTM, and GRU were used to compare the feature versions.Source: 2) Accuracy evaluation of… · p. 8
  • 95.11%, 96.56%, and 96.75% accuracy for updated features on CNN, LSTM, and GRU, respectively; updating improved prior results by around 1%∼5%.The authors retain features summarized from potential malicious behaviors as part of the input set.Source: 2) Accuracy evaluation of… · p. 8, Table VII · p. 8

3) Accuracy evaluation of feature category selection and deep neural network selection:

MobiTive combines manifest properties and API calls, with RNNs—especially GRU variants—outperforming CNNs in accuracy. Against existing approaches, it reports faster feature extraction with accuracy that is higher than some baselines and slightly lower than MobiDroid.

3) Accuracy evaluation of feature category selection and deep neural network selection:

  • Migration to TensorFlow Lite reduces original model size threefold for RNNs and fivefold for CNNs, with migrated size unchanged by quantization.The reported size comparisons are shown in Fig. 4.Source: Figure 4 · p. 9, 3) Accuracy evaluation of feature… · p. 9
  • Using manifest properties and API calls together gives the best accuracy among the tested feature categories, while RNN models generally outperform CNNs.The three CNN models have accuracies of 79.89%, 93.17%, and 95.11%.Source: 3) Accuracy evaluation of feature… · p. 9
  • GRU and bidirectional GRU reach similar accuracies of 96.75% and 96.78%, respectively, exceeding the other tested RNN models.GRU and bidirectional GRU have precision/recall of 96.78%/96.72% and 96.57%/97.00%, respectively.Source: 3) Accuracy evaluation of feature… · p. 9

4) Comparison between the existing learning-based Android malware detection systems and MobiTive:

5) Accuracy evaluation of multi-class classification:

MobiTive uses a GRU classifier to distinguish 21 malware families across five malware types. It achieves 94.45% overall accuracy, although accuracy varies across families.

5) Accuracy evaluation of multi-class classification:

1) Performance evaluation of feature preparation on real devices:

MobiTive measures feature preparation and RNN prediction on real Android devices. Preparation time depends on app size and device, while GRU is selected for device-side evaluation because it combines the best prediction performance with near-leading accuracy.

1) Performance evaluation of feature preparation on real devices:

  • On Huawei P30, unzipping takes 0.046 seconds and feature extraction 0.092 seconds for 5MB apps; for 50MB apps, both steps take less than 0.6 and 0.49 seconds, respectively.On the Samsung Galaxy J7 Pro, unzipping takes 0.261 and 3.918 seconds for 5MB and 50MB apps, while feature extraction takes 0.516 and 5.452 seconds.Source: Figure 5 · p. 10, 1) Performance evaluation of feature… · p. 10, Figure 6 · p. 11
  • For 50MB apps, unzipping takes 1.023–2.586 seconds on common-specification devices, and feature extraction takes 2.089–6.216 seconds.For 5MB apps, the respective ranges are 0.119–0.264 seconds and 0.146–0.22 seconds.Source: 1) Performance evaluation of feature… · p. 10

2) Performance evaluation of RNN models on real device:

3) Accuracy and prediction time on different real devices:

On-device tests compare GRU accuracy and processing time across mobile devices, and compare MobiTive’s resource use with dynamic analysis. The authors report short average detection times, while noting that dynamic monitoring’s cost scales with the number and runtime of monitored apps.

4) Performance comparison between MobiTive and dynamic run-time detection:

  • For a single detection in the same limited period, Inspeckage has lower CPU use and energy consumption, but uses 130MB versus MobiTive’s 60MB memory.MobiTive detects once before installation and averages 0.46 seconds per app; Inspeckage monitors running apps continuously, with costs scaling by app count and runtime.Source: Table XI · p. 11, 4) Performance comparison between… · p. 12

3) Accuracy and prediction time on different real devices:

  • Quantized GRU accuracy is almost equal to non-quantized accuracy, while quantization changes prediction time by less than 0.01 microseconds.The underlying GRU accuracy is 96.75%; the authors note current TensorFlow Lite operator support limits the network structures to relatively simple ones.Source: 3) Accuracy and prediction time on… · p. 11
  • Detection takes less than 3 seconds on average on common devices and less than 1 second in best practice; the prediction phase is less than 1% of total time on common-specification devices.The authors identify feature preparation as the larger opportunity for reducing total detection time.Source: 3) Accuracy and prediction time on… · pp. 11–12

4) Performance comparison between MobiTive and dynamic run-time detection:

  • Dynamic-analysis costs scale with monitored app count and runtime, whereas MobiTive detects each app once before installation and can sleep between detections.The authors conclude that dynamic-analysis tools such as Inspeckage have higher costs in common Android-use scenarios.Source: 4) Performance comparison between… · p. 12

D. Analysis of Hardware Performance Evolution Trend of Android Mobile Devices

The hardware analysis finds rising chipset performance and device specifications that support MobiTive on most current Android phones. The discussion also identifies limits in feature coverage, detection of new malware families, and robustness to adversarial attacks.

D. Analysis of Hardware Performance Evolution Trend of Android Mobile Devices

V. LIMITATIONS AND DISCUSSIONS

  • Selecting only manifest properties and API calls limits overhead but may miss malware families whose malicious behavior is not represented by those features.The authors aim to add effective feature types with low performance costs.Source: §V · p. 13
  • A new malware family with features unlike the limited training data may defeat MobiTive's classifier, although learning-based approaches can sometimes detect new variants.The authors describe improving detection of new samples through combinations of techniques as future work.Source: §V · p. 13
  • The authors describe adversarial malware attacks as domain-specific and impractical so far, while identifying them as an open research direction.Their discussion notes that attacks often use untriggered code, which other techniques such as static data-flow analysis can detect.Source: §V · p. 13
  • Dynamic analysis may achieve lower false-positive rates on a given task, but its resource costs, behavior coverage, and runtime setting constrain applicability.The authors contrast these trade-offs with static analysis and call for research on both approaches.Source: §V · pp. 13–14

VI. RELATED WORK

Prior Android malware research includes manifest and API features, program analysis, and learning-based systems. MobiTive focuses on device-side deep learning, with the conclusion reporting fast detection on six real devices and analysis of specifications across over one hundred phones.

VI. RELATED WORK

  • Manifest and API-based prior work uses permissions, manifest files, API call frequency, and API or permission-related graphs to classify or detect Android malware.Examples include permission-based classifiers,, ComDroid, API-based approaches,, DroidSIFT, and DroidAlarm.Source: §VI · p. 14
  • Program-analysis approaches such as control-flow and inter-component communication graphs are described as more expensive than XML- or API-based approaches, but tending to be more precise.The cited work also includes taint analysis and deterministic symbolic automata,,.Source: §VI · p. 14
  • Learning-based work spans XML and API features, deep belief networks, convolutional networks, multiple neural networks, and staged detection systems.Examples include Drebin, Droid-detector, CNN-based detection, and DeepRefiner.Source: §VI · p. 14
  • Other prior techniques address data manipulation, combine static and dynamic analysis, monitor runtime information, or detect vulnerabilities and repackaged APKs.The passage also describes keyword-distance and app-behavior approaches.Source: §VI · p. 14
  • Unlike techniques focused on APK or source-code information on servers, MobiTive studies deep-learning malware detection on mobile devices through performance-based experiments.Source: §VI · p. 14

VII. CONCLUSION

  • MobiTive provides detection averaging less than three seconds; the authors evaluate it on six real devices and analyze performance trends across over one hundred phones.Source: §VII · p. 15
Loading 2005.04970v3…