Recently there is an upsurge in Android malware that use obfuscation and repackaging techniques for evasion. Malware may also combine both these techniques to create stealthy adversarial mimicry samples to launch mimicry attacks. In mimicry attacks, the adversary makes sure that the static and dynamic features present in the crafted malware mimics the features present in the legitimate applications. In such cases, the existing detection mechanisms may become less effective. We found that the malicious nature of Android applications can be determined by identifying certain subgraphs that appear in their system call graphs. These subgraphs can be determined with the help of spectral clustering mechanism present in EigenGCN. With this, the system call graph G will be partitioned into two subgraphs G1 and G2, in which the malicious functionality if any will be present in the subgraph G1. The graph Fourier transform based pooling technique in EigenGCN then computes the features of the subgraphs in the form of graph signals. This graph signals serve as a robust signature to detect malware. The proposed mechanism gave an accuracy of 98.7% on common malware, 97.3% on obfuscated malware, 97.8% on repackaged malware, and 90% on adversarial mimicry malware datasets. As far as we know, this is the first work that proposes a malware detection mechanism, that can detect common as well as obfuscated, repackaged, and mimicry malware in Android.

The popularity of Android mobile phones has caused more cybercriminals to create malware applications that carry out various malicious activities. The attacks, which escalated after the COVID-19 pandemic, proved there is great importance in protecting Android mobile devices from malware attacks. Intelligent Mobile Malware Detection will teach users how to develop intelligent Android malware detection mechanisms by using various graph and stochastic models. The book begins with an introduction to the Android operating system accompanied by the limitations of the state-of-the-art static malware detection mechanisms as well as a detailed presentation of a hybrid malware detection mechanism. The text then presents four different system call-based dynamic Android malware detection mechanisms using graph centrality measures, graph signal processing and graph convolutional networks. Further, the text shows how most of the Android malware can be detected by checking the presence of a unique subsequence of system calls in its system call sequence. All the malware detection mechanisms presented in the book are based on the authors' recent research. The experiments are conducted with the latest Android malware samples, and the malware samples are collected from public repositories. The source codes are also provided for easy implementation of the mechanisms. This book will be highly useful to Android malware researchers, developers, students and cyber security professionals to explore and build defense mechanisms against the ever-evolving Android malware. © 2023 Tony Thomas, Roopak Surendran, Teenu S. John, and Mamoun Alazab. All rights reserved.

With the widespread usage of Android mobile devices, malware developers are increasingly targeting Android applications for carrying out their malicious activities. Despite employing powerful malware detection mechanisms, an adversary can evade the threat detection model by launching intelligent malware with fine-grained feature perturbations. Since machine learning is widely adopted in malware detection owing to its automatic threat prediction and detection capabilities, attackers are nowadays targeting the vulnerability of machine learning models for malicious activities. In this work, we demonstrate how an adversary can evade various machine learning based static and dynamic Android malware detection mechanisms. To the best of our knowledge, this is the first work that discusses adversarial evasion in both static and dynamic machine learning based malware detection mechanisms.

Nowadays, Android malwares have risen precipitously causing critical security threats. Malware authors now employ a variety of obfuscation techniques to evade their detection. Among various features, system calls are one of the major features used for detecting malwares. Although obfuscated malwares use diverse methods to conceal their malicious nature, the dependencies between the system calls can reveal their malicious nature. The existing malware detection models do not take into account of these structural dependencies and have large feature dimensions. Modelling the system calls as graphs can help in capturing the structural dependencies between the system calls. Recently, there has been an increasing interest in extending deep learning models such as Graph Convolutional Nets (GCN) for graph data. Motivated by this, we propose a novel Android malware detection mechanism using GCN which uses centrality measures of the graph as input features. To the best of our knowledge this is the first application of GCN for dynamic Android malware detection. We achieved a four dimensional feature representation for Android applications and a detection accuracy of 92.30 % on datasets with obfuscated malwares.

Machine learning has found its immense application in various cybersecurity domains owing to its automated threat prediction and detection capabilities. Despite its advantages, attackers can utilize the vulnerabilities of machine learning models for degrading its performance. These attacks called adversarial attacks can perturb the features of the data to induce misclassification. Adversarial attacks are highly destructive in the case of malware detection classifiers, causing a harmful virus or trojan to evade the threat detection system. The feature perturbations carried out by an adversary against malware detection classifiers are different from the conventional attack strategies employed by an adversary against computer vision tasks. This chapter discusses various adversarial attacks launched against malware detection classifiers and the existing defensive mechanisms. The authors also discuss the challenges and the research directions that need to be addressed to develop effective defensive mechanisms against these attacks.