More Semantics More Robust: Improving Android Malware Classifiers
Automatic malware classifiers often perform badly on the detection of new malware, i.e. their robustness is poor. We study the machine learning based mobile malware classifiers and reveal one reason: the input features used by these classifiers can't capture general behavioural patterns of malware instances. We extract the best performing syntax based features like permissions and API calls, and some semantics based features like happen befores and unwanted behaviours, and train classifiers using popular supervised and semi supervised learning methods. By comparing their classification performance on industrial datasets collected across several years, we demonstrate that using semantics based features can dramatically improve robustness of malware classifiers.
WISEC