Maat: Automatically Analyzing VirusTotal for Accurate Labeling and Effective Malware Detection

被引:23
作者
Salem, Aleieldin [1 ]
Banescu, Sebastian [1 ]
Pretschner, Alexander [1 ]
机构
[1] Tech Univ Munich, Boltzmannstr 3, D-85748 Garching, Germany
关键词
Android security; malware detection; machine learning;
D O I
10.1145/3465361
中图分类号
TP [自动化技术、计算机技术];
学科分类号
0812 ;
摘要
The malware analysis and detection research community relies on the online platform VirusTotal to label Android apps based on the scan results of around 60 antiviral scanners. Unfortunately, there are no standards on how to best interpret the scan results acquired from VirusTotal, which leads to the utilization of different threshold-based labeling strategies (e.g., if 10 or more scanners deem an app malicious, it is considered malicious). While some of the utilized thresholds may be able to accurately approximate the ground truths of apps, the fact that VirusTotal changes the set and versions of the scanners it uses makes such thresholds unsustainable over time. We implemented a method, Maat, that tackles these issues of standardization and sustainability by automatically generating a Machine Learning (ML)-based labeling scheme, which outperforms threshold-based labeling strategies. Using the VirusTotal scan reports of 53K Android apps that span 1 year, we evaluated the applicability of Maat's Machine Learning (ML)-based labeling strategies by comparing their performance against threshold-based strategies. We found that such ML-based strategies (a) can accurately and consistently label apps based on their VirusTotal scan reports, and (b) contribute to training ML-based detection methods that are more effective at classifying out-of-sample apps than their threshold-based counterparts.
引用
收藏
页数:35
相关论文
共 44 条
[1]  
Allix K, 2016, 13TH WORKING CONFERENCE ON MINING SOFTWARE REPOSITORIES (MSR 2016), P468, DOI [10.1145/2901739.2903508, 10.1109/MSR.2016.056]
[2]  
[Anonymous], 2008, ASTM Int, V08, P1, DOI DOI 10.1520/C0157,08
[3]   Drebin: Effective and Explainable Detection of Android Malware in Your Pocket [J].
Arp, Daniel ;
Spreitzenbarth, Michael ;
Huebner, Malte ;
Gascon, Hugo ;
Rieck, Konrad .
21ST ANNUAL NETWORK AND DISTRIBUTED SYSTEM SECURITY SYMPOSIUM (NDSS 2014), 2014,
[4]  
Arshad S, 2016, INT J ADV COMPUT SC, V7, P463
[5]  
AV-Test: The Independent IT-Security Institute, 2019, BEST ANT SOFTW ANDR
[6]   The advantages of the Matthews correlation coefficient (MCC) over F1 score and accuracy in binary classification evaluation [J].
Chicco, Davide ;
Jurman, Giuseppe .
BMC GENOMICS, 2020, 21 (01)
[7]  
Dunham Ken, 2014, ANDROID MALWARE ANAL
[8]   A review on feature selection in mobile malware detection [J].
Feizollah, Ali ;
Anuar, Nor Badrul ;
Salleh, Rosli ;
Wahab, Ainuddin Wahid Abdul .
DIGITAL INVESTIGATION, 2015, 13 :22-37
[9]   Euphony: Harmonious Unification of Cacophonous Anti-Virus Vendor Labels for Android Malware [J].
Hurier, Mederic ;
Suarez-Tangil, Guillermo ;
Dash, Santanu Kumar ;
Bissyande, Tegawende F. ;
Le Traon, Yves ;
Klein, Jacques ;
Cavallaro, Lorenzo .
2017 IEEE/ACM 14TH INTERNATIONAL CONFERENCE ON MINING SOFTWARE REPOSITORIES (MSR 2017), 2017, :425-435
[10]  
Hurier M, 2016, LECT NOTES COMPUT SC, V9721, P142, DOI 10.1007/978-3-319-40667-1_8