Maat: Automatically Analyzing VirusTotal for Accurate Labeling and Effective Malware Detection

07/01/2020
by   Aleieldin Salem, et al.
0

The malware analysis and detection research community relies on the online platform VirusTotal to label Android apps based on the scan results of around 60 antiviral scanners. Unfortunately, there are no standards on how to best interpret the scan results acquired from VirusTotal, which leads to the utilization of different threshold-based labeling strategies (e.g., if ten or more scanners deem an app malicious, it is considered malicious). While some of the utilized thresholds may be able to accurately approximate the ground truths of apps, the fact that VirusTotal changes the set and versions of the scanners it uses makes such thresholds unsustainable over time. We implemented a method, Maat, that tackles these issues of standardization and sustainability by automatically generating a Machine Learning (ML)-based labeling scheme, which outperforms threshold-based labeling strategies. Using the VirusTotal scan reports of 53K Android apps that span one year, we evaluated the applicability of Maat's ML-based labeling strategies by comparing their performance against threshold-based strategies. We found that such ML-based strategies (a) can accurately and consistently label apps based on their VirusTotal scan reports, and (b) contribute to training ML-based detection methods that are more effective at classifying out-of-sample apps than their threshold-based counterparts.

READ FULL TEXT
research
07/01/2020

Towards Accurate Labeling of Android Apps for Reliable Malware Detection

In training their newly-developed malware detection methods, researchers...
research
04/24/2020

Why an Android App is Classified as Malware? Towards Malware Classification Interpretation

Machine learning (ML) based approach is considered as one of the most pr...
research
03/25/2019

Don't Pick the Cherry: An Evaluation Methodology for Android Malware Detection Methods

In evaluating detection methods, the malware research community relies o...
research
12/05/2021

On Impact of Semantically Similar Apps in Android Malware Datasets

Malware authors reuse the same program segments found in other applicati...
research
05/12/2020

Android Malware Clustering using Community Detection on Android Packages Similarity Network

The daily amount of Android malicious applications (apps) targeting the ...
research
05/25/2022

Towards a Fair Comparison and Realistic Design and Evaluation Framework of Android Malware Detectors

As in other cybersecurity areas, machine learning (ML) techniques have e...
research
08/01/2018

Tackling Android Stego Apps in the Wild

Digital image forensics is a young but maturing field, encompassing key ...

Please sign up or login with your details

Forgot password? Click here to reset