K-평균 클러스터링 기반 안드로이드 악성 앱 탐지 기법의 지속가능성 개선
Enhancing Sustainability of an Android Malware Detection Technique using K-means Clustering
1
조회
0
다운로드
0
인용
0
참고문헌
키워드
초록
전통적인 기계학습 기반 안드로이드 악성 앱 탐지 기법은 개념 드리프트(concept drift)로 인해 새로운 유형의 악성 앱들을 탐지하는데 한계가 있다. 즉, 전통적인 기계학습 기반의 악성 앱 탐지 기법은 지속 가능하지 않을 수 있다. 개념 드리프트는 시간이 지남에 따라 악성 앱 특징의 진화와 이로 인한 기계학습 기반 탐지 모델의 성능 저하를 말한다. 본 논문에서는 API 호출 정보 및 기계학습을 사용하여 안드로이드 악성 앱을탐지하는 방법의 지속가능성을 개선하는 기법을 제안한다. 제안 기법에서는, 먼저 K-평균 클러스터링으로 앱들을 그룹화한 후, 각 그룹별로 악성 앱을 탐지하는 분류모델을 개발한다. K-평균 클러스터링 과정에서는 최적의 k 값을 찾는 엘보우 방법(elbow method), 그리고 클러스터별 분류기에 임계값 지정과 초매개변수의 최적화 과정을 적용한다. 분류모델로는 랜덤 포레스트, K-최근접 이웃, AdaBoost를 사용한다. 실험 결과, 랜덤포레스트 분류기가 가장 높은 성능을 보였는데, 마이크로-평균 방식으로 산출된 F1 점수와 AUT 수치가 기존의 전통적인 랜덤 포레스트 모델보다 각각 20.1%p, 20.4%p 개선되었다.
Abstract
Traditional machine learning-based Android malicious app(malware) detection techniques have limitations in detecting new types of malware due to concept drift. In other words, traditional machine learning-based malware detection techniques may not be sustainable. Concept drift refers to the evolving nature of malware features over time and the resulting degradation in the performance of machine learning-based detection models In this paper, we propose a technique to improve the sustainability of the method for detecting Android malware using API call information and machine learning. In the proposed technique, apps are first grouped using K-means clustering, and then classification models are applied to detect malicious apps for each group. In the K-means clustering, the elbow method is used to find the optimal k value, and thresholding and hyperparameter optimization processes are applied to the classifiers for each cluster. The classifiers include random forest, K-nearest neighbor, and AdaBoost. The experimental results show that the random forest classifier showed the highest performance, with the F1 score and AUT value calculated by the micro-means method being improved by 20.1%p and 20.4%p, respectively, compared to the traditional random forest model.
참고문헌 (20)
- K. Tam, "The evolution of android malware and android analysis techniques", ACM Computing Surveys, 49(4), pp.1~41 (2017)[DOI]
- Q. Wu, "A survey of android malware static detection technology based on machine learning", Mobile Information Systems, 2021, pp.1~18 (2021)[DOI]
- "Kaspersky discovers new Mandrake spyware campaign undetected for two years, with over 32,000 installs on Google Play" (2024)[URL]
- F. Pendlebury, "TESSERACT : Eliminating experimental bias in malware classification across space and time", 28th USENIX Security Symposium(USENIX Security 19), pp.1289~1306 (2019)
- H. Lee, "Enhancing sustainability in machine learning-based android malware detection using API calls", 2022 IEEE Fifth International Conference on Artificial Intelligence and Knowledge Engineering (AIKE), pp.131~134 (2022)
- W. S. Cho, "A Study on the Sustainability Improvement of Android Malicious App Detection through Year Data Set Combination Machine Learning", The Journal of Korean Institute of Next Generation Computing, 18(5), pp.47~57 (2022)[DOI]
- S. W. Jeong, "A K-means Based Classification Model for the Sustainability of Android Malware Detection", Workshop on Dependable and Secure Computing, pp.172~177 (2024)
- N. Peiravian, "Machine learning for android malware detection using permission and api calls", 2013 IEEE 25th International Conference on Tools with Artificial Intelligence, pp.300~305 (2013)
- J. M Jung, "Feature engineering and evaluation for android malware detection scheme", Journal of Internet Technology, 22, pp.423~440 (2021)[DOI]
- D. Arp, "Drebin : Effective and explainable detection of android malware in your pocket", The Network and Distributed System Security Symposium, 14, pp.23~26 (2014)
- Y. Aafer, "Droidapiminer : Mining api-level features for robust malware detection in android", International Conference on Security and Privacy in Communication Systems, pp.86~103 (2013), Springer
- S. M. Lee, "A Hierarchical Clustering Hybrid Model for the Sustainability of Android Malicious Application Detection", Workshop on Dependable and Secure Computing, pp.178~183 (2024)
- Thorndike, R. L, "Who belongs in the family?", Psychometrika, 18(4), pp.267~276 (1953)[DOI]
- D. Arthur, "K-means++: The advantages of careful seeding", Proceedings of the Eighteenth Annual ACM-SIAM Symposium on Discrete Algorithms (SODA), pp.1027~1035 (2007)
- T. Hastie, "The Elements of Statistical Learning", pp.532~ (2009), Springer
- F. Pedregosa, "Scikit-learn : Machine learning in Python", Journal of Machine Learning Research, 12, pp.2825~2830 (2011)
- K. Allix, "AndroZoo : Collecting millions of Android apps for the research community", IEEE, 2016, 468~471
- "AndroZoo Documentation" (2023)[URL]
- "dexdump.cc" (2024)[URL]
- M. Sokolova, "A systematic analysis of performance measures for classification tasks", Information Processing and Management, 45, pp.427~437 (2009)[DOI]