ALDROID: efficient update of Android anti-virus software using designated active learning methods

详细信息    查看全文

• 作者：Nir Nissim ; Robert Moskovitch ; Oren BarAd ; Lior Rokach…
• 关键词：Detection ; Acquisition ; Malware ; Android ; Active learning ; Anti ; virus ; Application
• 刊名：Knowledge and Information Systems
• 出版年：2016
• 出版时间：December 2016
• 年：2016
• 卷：49
• 期：3
• 页码：795-833
• 全文大小：1,536 KB
• 刊物类别：Computer Science
• 刊物主题：Information Systems and Communication Service
  Business Information Systems
  
• 出版者：Springer London
• ISSN：0219-3116
• 卷排序：49

文摘

Many new unknown malwares aimed at compromising smartphones are created constantly. These widely used smartphones are very dependent on anti-virus solutions due to their limited resources. To update the anti-virus signature repository, anti-virus vendors must deal with vast quantities of new applications daily in order to identify new unknown malwares. Machine learning algorithms have been used to address this task, yet they must also be efficiently updated on a daily basis. To improve detection and updatability, we introduce a new framework, “ALDROID” and active learning (AL) methods on which ALDROID is based. Our methods are aimed at selecting only new informative applications (benign and especially malicious), thus reducing the labeling efforts of security experts, and enable a frequent and efficient process of enhancing the framework’s detection model and Android’s anti-virus software. Results indicate that our AL methods outperformed other solutions including the existing AL method and heuristic engine. Our AL methods acquired the largest number and percentage of new malwares, while preserving the detection models’ detection capabilities (high TPR and low FPR rates). Specifically, our methods acquired more than double the amount of new malwares acquired by the heuristic engine and 6.5 times more malwares than the existing AL method.