Analysis of Dataset Shifts in Mobile Malware

• Applicant: Dr.-Ing. Daniel Arp
• Subject Area: Security and Dependability, Operating-, Communication- and Distributed Systems ; Image and Language Processing, Computer Graphics and Visualisation, Human Computer Interaction, Ubiquitous and Wearable Computing ; Theoretical Computer Science
• Term: from 2021 to 2024
• Project identifier: Deutsche Forschungsgemeinschaft (DFG) - Project number 456292463

The popularity of mobile devices, such as smartphones and tablets, has grown significantly in the past decade. Unfortunately, theirpopularity has also made them a profitable target for malware authors, leaving these devices often unprotected, as anti-virus vendors cannot always provide updates for their products on time.To compensate for the weaknesses of current anti-virus scanners, researchers have proposed various methods for the detection of mobile malware based on machine learning. These approaches have proven to be capable of deriving effective patterns to detect malware automatically. Most recently, however, it has been shown that the detection performance of these methods decreases over time, a phenomenon referred to as "dataset shift" in machine learning theory. While, for instance, the growing use of obfuscation techniques in mobile applications explains parts of these observations, the causes for dataset shift in this domain are mostly still unknown.In this project, we aim to gather a comprehensive understanding of the reasons behind dataset shift and how to alleviate its impact on the detection performance of learning-based systems for mobile malware detection. To this end, we guide our research along the following two steps: In the first step, we analyze the detection capabilities of existing approaches over time by adapting methods for interpreting machine learning models. This way, we attempt to identify factors that impede the detection of mobile malware and are primarily responsible for the emergence of dataset shift. In the second step, we explore different feature spaces to develop suitable methods for detecting mobile malware over time.

• DFG Programme: WBP Fellowship
• International Connection: United Kingdom
• Host: Professor Lorenzo Cavallaro