Android malware detection is an important research topic in the security area. There are a variety of existing malware detection models based on static and dynamic malware analysis. However, most of these models are not very successful when it comes to evasive malware detection. In this study, we aimed to create a malware detection model based on a natural language model called skip-gram to detect evasive malware with the highest accuracy rate possible. In order to train and test our proposed model, we used an up-to-date malware dataset called Argus Android Malware Dataset (AMD) since the AMD contains various evasive malware families and detailed information about them. Meanwhile, for the benign samples, we used Comodo Android Benign Dataset. Our proposed model starts with extracting skip-gram-based features from instruction sequences of Android applications. Then it applies several machine learning algorithms to classify samples as benign or malware. We tested our proposed model with two different scenarios. In the first scenario, the random forest-based classifier performed with 95.64% detection accuracy on the entire dataset and 95% detection accuracy against evasive only samples. In the second scenario, we created a test dataset that contained zero-day malware samples only. For the training set, we did not use any sample that belongs to the malware families in the test set. The random forest-based model performed with 37.36% accuracy rate against zero-day malware. In addition, we compared our proposed model’s malware detection performance against several commercial antimalware applications using VirusTotal API. Our model outperformed 7 out of 10 antimalware applications and tied with one of them on the same test scenario.

中文翻译：

---

通过基于Skip-Gram的恶意软件检测与移动逃避恶意软件进行战斗

Android恶意软件检测是安全领域的重要研究主题。现有许多基于静态和动态恶意软件分析的恶意软件检测模型。但是，在回避恶意软件检测方面，大多数模型都不是很成功。在这项研究中，我们旨在基于称为“跳过语法”的自然语言模型创建恶意软件检测模型，以尽可能高的准确率检测逃避性恶意软件。为了训练和测试我们提出的模型，我们使用了称为Argus Android恶意软件数据集（AMD）的最新恶意软件数据集，因为AMD包含各种逃避性恶意软件家族及其详细信息。同时，对于良性示例，我们使用了Comodo Android Benign Dataset。我们提出的模型首先从Android应用程序的指令序列中提取基于跳过语法的功能。然后，它应用多种机器学习算法将样本分类为良性或恶意软件。我们在两种不同的情况下测试了我们提出的模型。在第一种情况下，基于随机森林的分类器在整个数据集上的检测精度为95.64％，而对于仅规避样本的检测器的检测精度为95％。在第二种情况下，我们创建了一个仅包含零日恶意软件样本的测试数据集。对于训练集，我们没有使用测试集中属于恶意软件家族的任何样本。基于随机森林的模型针对零日恶意软件的准确率达到37.36％。此外，我们使用VirusTotal API将我们建议的模型的恶意软件检测性能与几个商业反恶意软件应用程序进行了比较。我们的模型优于10个反恶意软件应用程序中的7个，并在相同的测试场景中与其中一个捆绑在一起。