DeepFlow: Deep learning-based malware detection by mining Android application for abnormal usage of sensitive data

Abstract

The open nature of Android allows application developers to take full advantage of the system. While the flexibility is brought to developers and users, it may raise significant issues related to malicious applications. Traditional malware detection approaches based on signatures or abnormal behaviors are invalid when dealing with novel malware. To solve the problem, machine learning algorithms are used to learn the distinctions between malware and benign apps automatically. Deep learning, as a new area of machine learning, is developing rapidly as its better characterization of samples. We thus propose DeepFlow, a novel deep learning-based approach for identifying malware directly from the data flows in the Android application. We test DeepFlow on thousands of benignware and malware. The results show that DeepFlow can achieve a high detection F1 score of 95.05%, outperforming traditional machine learning-based approaches, which reveals the advantage of deep learning technique in malware detection.