Multi-label Classification for Android Malware Based on Active Learning
<|reference_start|>Multi-label Classification for Android Malware Based on Active Learning: The existing malware classification approaches (i.e., binary and family classification) can barely benefit subsequent analysis with their outputs. Even the family classification approaches suffer from lacking a formal naming standard and an incomplete definition of malicious behaviors. More importantly, the existing approaches are powerless for one malware with multiple malicious behaviors, while this is a very common phenomenon for Android malware in the wild. So, neither of them can provide researchers with a direct and comprehensive enough understanding of malware. In this paper, we propose MLCDroid, an ML-based multi-label classification approach that can directly indicate the existence of pre-defined malicious behaviors. With an in-depth analysis, we summarize six basic malicious behaviors from real-world malware with security reports and construct a labeled dataset. We compare the results of 70 algorithm combinations to evaluate the effectiveness (best at 73.3%). Faced with the challenge of the expensive cost of data annotation, we further propose an active learning approach based on data augmentation, which can improve the overall accuracy to 86.7% with a data augmentation of 5,000+ high-quality samples from an unlabeled malware dataset. This is the first multi-label Android malware classification approach intending to provide more information on fine-grained malicious behaviors.<|reference_end|>
@article{qiao2024multi-label,
    title={Multi-label Classification for Android Malware Based on Active Learning},
    author={Qijing Qiao, Ruitao Feng, Sen Chen, Fei Zhang, Xiaohong Li},
    journal={arXiv preprint arXiv:2410.06444},
    year={2024},
    doi={10.1109/TDSC.2022.3213689},
    archivePrefix={arXiv},
    eprint={2410.06444},
    primaryClass={cs.CR}
}