With the proliferation of Android malware, the demand for an effective and efficient malware detection system is on the rise. The existing device-end learning based solutions tend to extract limited syntax features (e.g., permissions and API calls) to meet a certain time constraint of mobile devices. However, syntax features lack the semantics which can represent the potential malicious behaviors and further result in more robust model with high accuracy for malware detection. In this paper, we propose an efficient Android malware detection system, named SeqMobile, which adopts behavior-based sequence features and leverages customized deep neural networks on mobile devices instead of the server. Different from the traditional sequence-based approaches on server, to meet the performance demand, SeqMobile accepts three effective performance optimization methods to reduce the time cost. To evaluate the effectiveness and efficiency of our system, we conduct experiments from the following aspects 1) the detection accuracy of different recurrent neural networks; 2) the feature extraction performance on different mobile devices, 3) the detection accuracy and prediction time cost of different sequence lengths. The results unveil that SeqMobile can effectively detect malware with high accuracy. Moreover, our performance optimization methods have proven to improve the performance of training and prediction by at least twofold. Additionally, to discover the potential performance optimization from the SOTA TensorFlow model optimization toolkit for our approach, we also provide an evaluation on the toolkit, which can serve as a guidance for other systems leveraging on sequence-based learning approach. Overall, we conclude that our sequence-based approach, together with our performance optimization methods, enable us to detect malware under the performance demands of mobile devices.

中文翻译：

---

SeqMobile：在移动设备上使用 RNN 的基于序列的高效 Android 恶意软件检测系统

随着 Android 恶意软件的激增，对有效且高效的恶意软件检测系统的需求正在上升。现有的基于设备端学习的解决方案倾向于提取有限的语法特征（例如权限和API调用）以满足移动设备的一定时间限制。然而，语法特征缺乏可以表示潜在恶意行为的语义，并进一步导致更强大的模型具有更高的恶意软件检测精度。在本文中，我们提出了一种名为 SeqMobile 的高效 Android 恶意软件检测系统，该系统采用基于行为的序列特征并利用移动设备而不是服务器上的定制深度神经网络。与传统的基于序列的服务器方式不同，为了满足性能需求，SeqMobile 接受三种有效的性能优化方法来降低时间成本。为了评估我们系统的有效性和效率，我们从以下几个方面进行实验：1）不同循环神经网络的检测精度；2）不同移动设备上的特征提取性能，3）不同序列长度的检测精度和预测时间成本。结果表明，SeqMobile 可以有效且准确地检测恶意软件。此外，我们的性能优化方法已被证明可以将训练和预测的性能提高至少两倍。此外，为了从 SOTA TensorFlow 模型优化工具包中为我们的方法发现潜在的性能优化，我们还提供了对该工具包的评估，这可以作为其他系统利用基于序列的学习方法的指导。总的来说，我们得出的结论是，我们基于序列的方法以及我们的性能优化方法使我们能够在移动设备的性能需求下检测恶意软件。