一句话：提出 MalScan，用函数调用图的社会网络中心性做轻量 Android 恶意软件检测。
现有 Android 恶意软件扫描中，语法特征易被变换攻击规避，语义特征却依赖昂贵程序分析，难以市场级扩展。本文提出轻量图方法 MalScan：把应用函数调用图视为社交网络，用中心性分析提取图语义特征，获得简洁且容错的表示。作者在 15,285 个良性样本和 15,430 个恶意样本上评估，准确率最高 98%，单样本耗时不足一秒，比 MaMaDroid 和 Drebin 快 100 倍以上；对 300 多万应用的市场级统计验证了可行性，并在 Google Play 数据集中发现 18 个零日恶意软件，包括可规避现有工具的样本。
Malware scanning of an app market is expected to be scalable and effective. However, existing approaches use either syntax-based features which can be evaded by transformation attacks or semantic-based features which are usually extracted by performing expensive program analysis. Therefor, in this paper, we propose a lightweight graph-based approach to perform Android malware detection. Instead of traditional heavyweight static analysis, we treat function call graphs of apps as social networks and perform social-network-based centrality analysis to represent the semantic features of the graphs. Our key insight is that centrality provides a succinct and fault-tolerant representation of graph semantics, especially for graphs with certain amount of inaccurate information (e.g., inaccurate call graphs). We implement a prototype system, MalScan, and evaluate it on datasets of 15,285 benign samples and 15,430 malicious samples. Experimental results show that MalScan is capable of detecting Android malware with up to 98% accuracy under one second which is more than 100 times faster than two state-of-the-art approaches, namely MaMaDroid and Drebin. We also demonstrate the feasibility of MalScan on market-wide malware scanning by performing a statistical study on over 3 million apps. Finally, in a corpus of dataset collected from Google-Play app market, MalScan is able to identify 18 zero-day malware including malware samples that can evade detection of existing tools.
DOI 原文 ·
@inproceedings{paperbot5262,
title = {MalScan: Fast Market-Wide Mobile Malware Scanning by Social-Network Centrality Analysis},
author = {Yueming Wu and Xiaodi Li and Deqing Zou and Wei Yang and Xin Zhang and Hai Jin},
booktitle = {ASE},
year = {2019},
doi = {10.1109/ase.2019.00023}
}