Investigations on android malware detection in adversarial settings

Abstract

newline Smartphone usage has become an indispensable activity of late with the Android Operating System (OS) having a magnanimous volume of usage. Due to its open source nature, Android OS based applications lure attackers. Malicious software intentionally manifests multi-sided violations without the consent of end-users and could accentuate illicit financial gains. Therefore, there is a need to raise the stakes to protect sensitive data. Tackling the rapid upsurge in the volume and veracity of malware variants have become a demanding need for automation of security solutions like Anti Malware Engine (AME) otherwise called Anti Virus (AV) software. Combating malware is a cyclical arms race between security analysts and attackers. To streamline and speed up the ability to retaliate malware, applying learning based techniques has become a prospective solution. Thus, malware detection models can be built by utilizing Machine Learning (ML) or Deep Learning (DL) or ensemble classification algorithms which can recognize and categorize an incoming sample as malware or goodware. Natively, learning based models function using the Independent and Identically Distributed (IID) assumption which states that the training and testing data are identical and independent of each other. But, in real-world usage of learning based models, distribution of data contained in training and test dataset can be significantly different causing non - stationary environment. Attackers intentionally attempt to violate the underlying IID assumptions made by classifiers to disrupt the working of learning based models. Attacks can occur at model training time or model inference time.