AEDroid: Adaptive Enhanced Android Malware Detection‐Based on Interpretability of Deep Learning

As the most widely used operating system in the world, Android has naturally become the main target of malicious hackers. The current research on Android malware detection relies on manually defined sensitive API feature sets. With the continuous innovation and change of malicious behavior, new threats and attack methods have emerged. If we still rely on the original sensitive API set, malicious applications will not be discovered. To address this issue, we do not use the existing sensitive API feature set but instead design a key activation mechanism (KAM) based on convolutional neural networks (CNNs) to obtain sensitive API. We use this mechanism to automatically mine API features that play an important role in determining maliciousness from application datasets. And we use the API group (ApiG) obtained through this mechanism for template generalization, and obtain a method called AEDroid that can delay model aging. By analyzing these API features, it was found that they not only cover the existing sensitive API feature types but also include sensitive APIs for seven new types of malicious behavior. The experimental results show that with the addition of the newly discovered sensitive API, the Android malware detection rate has increased by more than 5%, especially on newly emerged malicious datasets, where the effect is more pronounced.