API Call 정보 기반의 안드로이드 악성코드 분류를 위한 특성 집합 추출
Dimensionality Reduction of Feature Set for API Call based Android Malware Classification
1
조회
0
다운로드
1
인용
0
참고문헌
키워드
초록
악성코드를 포함한 모든 응용프로그램은 실행 시 API(Application Programming Interface)를 호출한다. 최근에는 이러한 특성을 활용하여 API Call 정보를 기반으로 악성코드를 탐지하고 분류하는 접근방법이 많은 관심을 받고 있다. 그러나 API Call 정보를 포함하는 데이터세트는 그 양이 방대하여 많은계산 비용과 처리시간이 필요하다. 또한, 악성코드 분류에 큰 영향을 미치지 않는 정보들이 학습모델의분류 정확도에 영향을 미칠 수도 있다. 이에 본 논문에서는 다양한 특성 선택(feature selection) 방법을적용하여 API Call 정보에 대한 차원을 축소시킨 후, 핵심 특성 집합을 추출하는 방안을 제시한다. 실험은 최근 발표된 안드로이드 악성코드 데이터세트인 CICAndMal2020을 이용하였다. 다양한 특성선택 방법으로 핵심 특성 집합을 추출한 후 CNN(Convolutional Neural Network)을 이용하여 안드로이드악성코드 분류를 시도하고 결과를 분석하였다. 그 결과 특성 선택 알고리즘에 따라 선택되는 특성집합이나 가중치 우선순위가 달라짐을 확인하였다. 그리고 이진분류의 경우 특성 집합을 전체 크기의15% 크기로 줄이더라도 97% 수준의 정확도로 악성코드를 분류하였다. 다중분류의 경우에는 최대 8% 이하의 크기로 특성 집합을 줄이면서도 평균 83%의 정확도를 달성하였다.
Abstract
All application programs, including malware, call the Application Programming Interface (API) upon execution. Recently, using those characteristics, attempts to detect and classify malware based on API Call information have been actively studied. However, datasets containing API Call information require a large amount of computational cost and processing time. In addition, information that does not significantly affect the classification of malware may affect the classification accuracy of the learning model. Therefore, in this paper, we propose a method of extracting a essential feature set after reducing the dimensionality of API Call information by applying various feature selection methods. We used CICAndMal2020, a recently announced Android malware dataset, for the experiment. After extracting the essential feature set through various feature selection methods, Android malware classification was conducted using CNN (Convolutional Neural Network) and the results were analyzed. The results showed that the selected feature set or weight priority varies according to the feature selection methods. And, in the case of binary classification, malware was classified with 97% accuracy even if the feature set was reduced to 15% of the total size. In the case of multiclass classification, an average accuracy of 83% was achieved while reducing the feature set to 8% of the total size.
참고문헌 (20)
- "Mobile Operating System Market Share Worldwide"[URL]
- "Mobile Operating System Market Share Worldwide"[URL]
- "Some 343 new Android malware samples every hour in 2017"[URL]
- Abir Rahali, "DIDroid: Android Malware Classification and Characterization Using Deep Image Learning", 10th International Conference on Communication and Network Security (ICCNS2020), pp.70~82 (2020)
- Naser Peiravian, "Machine Learning for Android Malware Detection Using Permission and API Calls", 2013 IEEE 25th International Conference on Tools with Artificial Intelligence, pp.300~305 (2014)
- Lucky Onwuzurike, "MaMaDroid", ACM Transactions on Privacy and Security, 22(2), pp.1~34 (2019), Association for Computing Machinery (ACM)[DOI]
- Andrea De Lorenzo, "Visualizing the outcome of dynamic analysis of Android malware with VizMal", Journal of Information Security and Applications, 50, pp.102423~ (2020), Elsevier BV[DOI]
- David Sean Keyes, "EntropLyzer: Android Malware Classification and Characterization Using Entropy Analysis of Dynamic Characteristics", 2021 Reconciling Data Analytics, Automation, Privacy, and Security: A Big Data Challenge (RDAAPS), 2021, pp.1~8 (2021)
- Suleiman Y. Yerima, "Machine learning-based dynamic analysis of Android apps with improved code coverage", EURASIP Journal on Information Security, 2019(1) (2019), Springer Science and Business Media LLC[DOI]
- Laya Taheri, "Extensible Android Malware Detection and Family Classification Using Network-Flows and API-Calls", 2019 International Carnahan Conference on Security Technology (ICCST)), pp.1~8 (2019)
- Rizgar Zebari, "A Comprehensive Review of Dimensionality Reduction Techniques for Feature Selection and Feature Extraction", Journal of Applied Science and Technology Trends, 1(2), pp.56~70 (2020), Interdisciplinary Publishing Academia[DOI]
- I. Sumaiya Thaseen, "Integrated Intrusion Detection Model Using Chi-Square Feature Selection and Ensemble of Classifiers", Arabian Journal for Science and Engineering, 44(4), pp.3357~3368 (2019), Springer Science and Business Media LLC[DOI]
- B Jyothi Kumar, "Logistic regression for polymorphic malware detection using ANOVA F-test", 2017 International Conference on Innovations in Information, Embedded and Communication Systems (ICIIECS), pp.1~34 (2019)
- N. Hoque, "MIFS-ND: A mutual information-based feature selection method", Expert Systems with Applications, 41(14), pp.6371~6385 (2014), Elsevier BV[DOI]
- Matthias Reif, "Efficient feature size reduction via predictive forward selection", Pattern Recognition, 47(4), pp.1664~1673 (2014), Elsevier BV[DOI]
- Hoai Bach Nguyen, "Filter based backward elimination in wrapper based PSO for feature selection in classification", 2014 IEEE Congress on Evolutionary Computation (CEC), pp.3111~3118 (2014)
- R Muthukrishnan, "LASSO: A feature selection technique in predictive modeling for machine learning", 2016IEEE International Conference on Advances in Computer Applications (ICACA), pp.18~20 (2017)
- Saurabh Paul, "Feature Selection for Ridge Regression with Provable Guarantees", Neural Computation, 28(4), pp.716~742 (2016), MIT Press - Journals[DOI]
- Hui Zou, "Regularization and variable selection via the elastic net", Journal of the Royal Statistical Society: Series B (Statistical Methodology), 67(2), pp.301~320 (2005), Wiley[DOI]
- Howida Abuabker Alkaaf, "Exploring permissions in android applications using ensemble-based extra tree feature selection", Indonesian Journal of Electrical Engineering and Computer Science, 19(1), pp.543~ (2020), Institute of Advanced Engineering and Science[DOI]