Explaining black-box android malware detection

Marco Melis
;
Davide Maiorca;Battista Biggio;Giorgio Giacinto;Fabio Roli
2018

Abstract

Machine-learning models have been recently used for detecting malicious Android applications, reporting impressive performances on benchmark datasets, even when trained only on features statically extracted from the application, such as system calls and permissions. However, recent findings have highlighted the fragility of such in-vitro evaluations with benchmark datasets, showing that very few changes to the content of Android malware may suffice to evade detection. How can we thus trust that a malware detector performing well on benchmark data will continue to do so when deployed in an operating environment? To mitigate this issue, the most popular Android malware detectors use linear, explainable machine-learning models to easily identify the most influential features contributing to each decision. In this work, we generalize this approach to any black-box machine- learning model, by leveraging a gradient-based approach to identify the most influential local features. This enables using nonlinear models to potentially increase accuracy without sacrificing interpretability of decisions. Our approach also highlights the global characteristics learned by the model to discriminate between benign and malware applications. Finally, as shown by our empirical analysis on a popular Android malware detection task, it also helps identifying potential vulnerabilities of linear and nonlinear models against adversarial manipulations.
Inglese
26th European Signal Processing Conference, EUSIPCO 2018
978-9-0827-9701-5
IEEE, Institute of Electrical and Electronics Engineers
Piscataway, NJ
STATI UNITI D'AMERICA
524
528
5
https://ieeexplore.ieee.org/document/8553598
The 26th European Signal Processing Conference (EUSIPCO)
Esperti anonimi
September 3-7, 2018
Rome, Italy
internazionale
scientifica
Malware; Feature extraction; Detectors; Machine learning; Support vector machines; Signal processing algorithms; Approximation algorithms
no
4 Contributo in Atti di Convegno (Proceeding)::4.1 Contributo in Atti di convegno
Melis, Marco; Maiorca, Davide; Biggio, Battista; Giacinto, Giorgio; Roli, Fabio
273
5
4.1 Contributo in Atti di convegno
partially_open
info:eu-repo/semantics/conferencePaper
File in questo prodotto:
File Dimensione Formato  
melis18-eusipco-v2.pdf

accesso aperto

Tipologia: versione pre-print
Dimensione 431.44 kB
Formato Adobe PDF
431.44 kB Adobe PDF Visualizza/Apri
melis18-eusipco-v3.pdf

Solo gestori archivio

Tipologia: versione post-print
Dimensione 431.78 kB
Formato Adobe PDF
431.78 kB Adobe PDF   Visualizza/Apri   Richiedi una copia

I documenti in IRIS sono protetti da copyright e tutti i diritti sono riservati, salvo diversa indicazione.

Questionario e social

Condividi su:
Impostazioni cookie