Android malware detection based on novel representations of apps

• Main Authors: SUN, Tiezhu, DAOUDI, Nadia, ALLIX, Kevin, SAMHI, Jordan, KIM, Kisub, ZHOU, Xin, KABORE, Abdoul K., KIM, Dongsun, David LO, BISSYANDE, Tegawende F., KLEIN, Jacques
• Format: text
• Language: English
• Published: Institutional Knowledge at Singapore Management University 2025
• Subjects: Information Security; Software Engineering
• Online Access: https://ink.library.smu.edu.sg/sis_research/9863
• Institution: Singapore Management University

In the past decade, advancements in computer vision (CV) and natural language processing (NLP) have been driven significantly by deep representation learning. This progress has made image and text representation learning appealing for applications in fields like malware detection, where deep learning methods can overcome the limitations of traditional hand-crafted feature-based approaches, offering enhanced adaptability to various malware variants. This chapter introduces two novel approaches in malware representation learning that leverage these advancements: DexRay and DexBERT. DexRay employs image-based techniques, transforming DEX file bytecode of apps into grayscale “vector” images. These images are then analyzed using a one-dimensional convolutional neural model to determine the presence of malware. DexBERT, inspired by the BERT language model, processes Smali instructions disassembled from bytecode to generate high-level embedding vectors. These vectors are pivotal for tasks such as malicious code localization and malware detection. Both DexRay and DexBERT have demonstrated significant improvements over traditional machine learning methods in malware detection, particularly in terms of accuracy, efficiency, and adaptability to new malware types. This chapter delves into the methodologies and experimental results of these techniques, highlighting their contributions to the field of malware detection and offering insights into their potential for broader applications in cybersecurity.