Android Malware Family Classification using Images from Dex Files
Munyeong Kang, Jihyeo Park, S.H. Park, Seong-je Cho, Minkyu Park · 2020
With the popularization 1 of the Android platform, Android malware occupies the largest portion of mobile malware. Malware family classification is important for fast and accurate detection. We propose a new detection method using images generated from Dex files of Android apps. We generate two kinds of images: one from an entire DEX file and one from a data section of a DEX file. We apply the CNN algorithm to the classification of both kinds of images. The experiments show that the proposed method classifies malware families with 91% accuracy for both cases. In the case of using only the data section, the performance of the ExploitLinuxLotoor family and Gappisin family were improved. Also, the deviation between Precision, Recall, and F1-Score was greatly reduced. The area under the Precision-Recall curve is almost the same in both experiments, which means that detection time can be shortened without deteriorating detection performance.