论文标题
一种对性能敏感的恶意软件检测系统，使用移动设备上的深度学习
A Performance-Sensitive Malware Detection System Using Deep Learning on Mobile Devices
论文作者
论文摘要
当前，Android恶意软件检测主要是在服务器端进行的，而恶意软件的数量越来越多。强大的计算资源为应用程序市场提供了更详尽的保护，而不是维持单个用户的检测。但是，除了官方市场提供的申请外，非官方市场和第三方资源的应用程序始终造成对最终用户的严重安全威胁。同时，如果首先下载了该应用程序，然后将其上传到服务器端进行检测，则这是一项耗时的任务，因为网络传输具有很多开销。此外，上传过程还遭受了攻击者的安全威胁。因此，需要在移动设备上进行最后的防御，这是必要的急需的。在本文中，我们提出了一个有效的Android恶意软件检测系统，该系统利用自定义的深神经网络，以在移动设备上提供实时和响应式检测环境。流动是预装的解决方案，而不是使用后安装后的应用程序扫描和监视引擎，这更实用和安全。由于各种性能限制，例如计算功率，内存大小和能量，因此无法在移动设备上直接部署和执行原始的深度学习模型。 Therefore, we evaluate and investigate the following key points:(1) the performance of different feature extraction methods based on source code or binary code;(2) the performance of different feature type selections for deep learning on mobile devices;(3) the detection accuracy of different deep neural networks on mobile devices;(4) the real-time detection performance and accuracy on different mobile devices;(5) the potential based on the evolution trend of mobile devices' specifications;最后，我们进一步提出了一个实用解决方案（Mobitive），以检测移动设备上的Android恶意软件。
Currently, Android malware detection is mostly performed on server side against the increasing number of malware. Powerful computing resource provides more exhaustive protection for app markets than maintaining detection by a single user. However, apart from the applications provided by the official market, apps from unofficial markets and third-party resources are always causing serious security threats to end-users. Meanwhile, it is a time-consuming task if the app is downloaded first and then uploaded to the server side for detection, because the network transmission has a lot of overhead. In addition, the uploading process also suffers from the security threats of attackers. Consequently, a last line of defense on mobile devices is necessary and much-needed. In this paper, we propose an effective Android malware detection system, MobiTive, leveraging customized deep neural networks to provide a real-time and responsive detection environment on mobile devices. MobiTive is a preinstalled solution rather than an app scanning and monitoring engine using after installation, which is more practical and secure. Original deep learning models cannot be directly deployed and executed on mobile devices due to various performance limitations, such as computation power, memory size, and energy. Therefore, we evaluate and investigate the following key points:(1) the performance of different feature extraction methods based on source code or binary code;(2) the performance of different feature type selections for deep learning on mobile devices;(3) the detection accuracy of different deep neural networks on mobile devices;(4) the real-time detection performance and accuracy on different mobile devices;(5) the potential based on the evolution trend of mobile devices' specifications; and finally we further propose a practical solution (MobiTive) to detect Android malware on mobile devices.
