Malicious code detection in android: the role of sequence characteristics and disassembling methods

• Published in: International journal of information security Vol. 22; no. 1; pp. 107 - 118
• Main Authors: Balikcioglu, Pinar G., Sirlanci, Melih, A. Kucuk, Ozge, Ulukapi, Bulut, Turkmen, Ramazan K., Acarturk, Cengiz
• Format: Journal Article
• Language: English
• Published: Berlin/Heidelberg Springer Berlin Heidelberg 01.02.2023; Springer Nature B.V
• Subjects: Accuracy; Coding and Information Theory; Communications Engineering; Computer Communication Networks; Computer Science; Contingency; Cryptology; Cybersecurity; Dismantling; Machine learning; Malware; Management of Computing and Information Systems; Mobile operating systems; Natural language processing; Networks; Operating Systems; Regular Contribution; Representations; Source code; Malware detection; Natural language processing; LSTM
• ISSN: 1615-5262; 1615-5270
• DOI: 10.1007/s10207-022-00626-2

The acceptance and widespread use of the Android operating system drew the attention of both legitimate developers and malware authors, which resulted in a significant number of benign and malicious applications available on various online markets. Since the signature-based methods fall short for detecting malicious software effectively considering the vast number of applications, machine learning techniques in this field have also become widespread. In this context, stating the acquired accuracy values in the contingency tables in malware detection studies has become a popular and efficient method and enabled researchers to evaluate their methodologies comparatively. In this study, we wanted to investigate and emphasize the factors that may affect the accuracy values of the models managed by researchers, particularly the disassembly method and the input data characteristics. Firstly, we developed a model that tackles the malware detection problem from a Natural Language Processing (NLP) perspective using Long Short-Term Memory (LSTM). Then, we experimented with different base units (instruction, basic block, method, and class) and representations of source code obtained from three commonly used disassembling tools (JEB, IDA, and Apktool) and examined the results. Our findings exhibit that the disassembly method and different input representations affect the model results. More specifically, the datasets collected by the Apktool achieved better results compared to the other two disassemblers.