一句话：揭示Drebin常靠良性特征而非恶意特征分类，提出降低良性特征优先级的方法以提升抗攻击性并保持准确率。
本文研究Android应用恶意与良性分类问题。作者分析流行恶意软件检测工具Drebin，发现其正确分类常依赖良性特征而非恶意特征，使分类器实质上成为良性应用检测器，虽准确率高却易受恶意应用仿良性特征攻击。为此，论文提出在检测中降低良性特征优先级、聚焦应用真正恶意部分的方法。评估表明，该方法能使分类器在攻击下更具韧性，同时保持较高的检测准确率。
This paper investigates the problem of classifying Android applications into malicious and benign. We analyze the performance of a popular malware detection tool, Drebin, and show that its correct classification decisions often stem from using benign rather than malicious features for making predictions. That, effectively, turns the classifier into a benign app detector rather than a malware detector. While such behavior allows the classifier to achieve a high detection accuracy, it also makes it vulnerable to attacks, e.g., by a malicious app pretending to be benign by using features similar to those of benign apps. In this paper, we propose an approach for deprioritizing benign features in malware detection, focusing the detection on truly malicious portions of the apps. We show that our proposed approach makes a classifier more resilient to attacks while still allowing it to maintain a high detection accuracy.
DOI 原文 ·
@inproceedings{paperbot5910,
title = {On benign features in malware detection},
author = {Michael Cao and Sahar Badihi and Khaled Ahmed and Peiyu Xiong and Julia Rubin},
booktitle = {ASE},
year = {2020},
doi = {10.1145/3324884.3418926}
}