Multi-label Classification for Android Malware Based on Active Learning

TL;DR

This paper introduces MLCDroid, a multi-label classification system for Android malware that identifies multiple malicious behaviors, utilizing active learning and data augmentation to improve accuracy and provide detailed malware analysis.

Contribution

It presents the first multi-label Android malware classification approach that detects multiple malicious behaviors and employs active learning to enhance accuracy with limited labeled data.

Findings

Achieved up to 73.3% effectiveness with algorithm comparison.

Improved accuracy to 86.7% using active learning and data augmentation.

Constructed a labeled dataset of six malicious behaviors from real-world malware.

Abstract

The existing malware classification approaches (i.e., binary and family classification) can barely benefit subsequent analysis with their outputs. Even the family classification approaches suffer from lacking a formal naming standard and an incomplete definition of malicious behaviors. More importantly, the existing approaches are powerless for one malware with multiple malicious behaviors, while this is a very common phenomenon for Android malware in the wild. So, neither of them can provide researchers with a direct and comprehensive enough understanding of malware. In this paper, we propose MLCDroid, an ML-based multi-label classification approach that can directly indicate the existence of pre-defined malicious behaviors. With an in-depth analysis, we summarize six basic malicious behaviors from real-world malware with security reports and construct a labeled dataset. We compare the results of 70 algorithm combinations to evaluate the effectiveness (best at 73.3%). Faced with the challenge of the expensive cost of data annotation, we further propose an active learning approach based on data augmentation, which can improve the overall accuracy to 86.7% with a data augmentation of 5,000+ high-quality samples from an unlabeled malware dataset. This is the first multi-label Android malware classification approach intending to provide more information on fine-grained malicious behaviors.