IntelliAV: Building an Effective On-Device Android Malware Detector
This addresses the need for effective, on-device malware detection for Android users, offering a practical solution to catch new and evasive malware that signature-based tools miss, though it is incremental in applying existing ML methods to a new context.
The paper tackled the problem of on-device malware detection on Android by proposing IntelliAV, a lightweight machine learning model that extracts features and performs inference directly on mobile devices, achieving better performance than major anti-malware products and showing robustness against obfuscation techniques.
The importance of employing machine learning for malware detection has become explicit to the security community. Several anti-malware vendors have claimed and advertised the application of machine learning in their products in which the inference phase is performed on servers and high-performance machines, but the feasibility of such approaches on mobile devices with limited computational resources has not yet been assessed by the research community, vendors still being skeptical. In this paper, we aim to show the practicality of devising a learning-based anti-malware on Android mobile devices, first. Furthermore, we aim to demonstrate the significance of such a tool to cease new and evasive malware that can not easily be caught by signature-based or offline learning-based security tools. To this end, we first propose the extraction of a set of lightweight yet powerful features from Android applications. Then, we embed these features in a vector space to build an effective as well as efficient model. Hence, the model can perform the inference on the device for detecting potentially harmful applications. We show that without resorting to any signatures and relying only on a training phase involving a reasonable set of samples, the proposed system, named IntelliAV, provides more satisfying performances than the popular major anti-malware products. Moreover, we evaluate the robustness of IntelliAV against common obfuscation techniques where most of the anti-malware solutions get affected.