一句话：系统评测 12 种基于学习的 Android 恶意软件检测器在代码混淆、概念漂移与对抗样本下的鲁棒性差异。
近年来，基于学习的 Android 恶意软件检测器大量涌现，可分为基于字符串、基于图像和基于图三类，多数在理想设定下表现良好。然而现实中检测器常面临分布外样本，如代码混淆、概念漂移（软件开发技术演进、新恶意软件类别出现）和对抗样本。已有工作缺乏对不同类型检测器在这些挑战环境下的系统比较。本文从三类中选取 12 个代表性检测器，分别在代码混淆、概念漂移和对抗样本场景下进行统一评测。实验表明，没有检测器能保持理想设定下的检测性能，且不同类型检测器在不同挑战环境下的性能差异显著。作者进一步识别了导致性能退化的因素，包括特征提取方法和学习模型的局限，并分析了不同检测器面对混淆、漂移和对抗样本时表现差异的原因，最后分别从用户和研究者角度给出实用建议，以帮助理解不同类型检测器并指导其性能与鲁棒性提升。
Recent years have witnessed the proliferation of learning-based Android malware detectors. These detectors can be categorized into three types, String-based, Image-based and Graph-based. Most of them have achieved good detection performance under the ideal setting. In reality, however, detectors often face out-of-distribution samples due to the factors such as code obfuscation, concept drift (e.g., software development technique evolution and new malware category emergence), and adversarial examples (AEs). This problem has attracted increasing attention, but there is a lack of comparative studies that evaluate the existing various types of detectors under these challenging environments. In order to fill this gap, we select 12 representative detectors from three types of detectors, and evaluate them in the challenging scenarios involving code obfuscation, concept drift and AEs, respectively. Experimental results reveal that none of the evaluated detectors can maintain their ideal-setting detection performance, and the performance of different types of detectors varies significantly under various challenging environments. We identify several factors contributing to the performance deterioration of detectors, including the limitations of feature extraction methods and learning models. We also analyze the reasons why the detectors of different types show significant performance differences when facing code obfuscation, concept drift and AEs. Finally, we provide practical suggestions from the perspectives of users and researchers, respectively. We hope our work can help understand the detectors of different types, and provide guidance for enhancing their performance and robustness.
DOI 原文 ·
@inproceedings{paperbot11464,
title = {A Comprehensive Study of Learning-based Android Malware Detectors under Challenging Environments},
author = {Cuiying Gao and Gaozhun Huang and Heng Li and Bang Wu and Yueming Wu and Wei Yuan},
booktitle = {ICSE},
year = {2024},
doi = {10.1145/3597503.3623320}
}