DQSroid: Dynamic Android Malware Detection Based on Quadruple Sequences and Data Augmentation
摘要
Dynamic analysis of Android malware makes it possible to run it in a secure virtual environment and observe the malicious behaviour it generates during operation. In the dynamic analysis of Android malware, techniques that circumvent static detection methods, such as code obfuscation and repackaging, become ineffective. Dynamic analysis typically represents software behavior through API sequences, which serve as the basis for determining whether software is malicious or not. However, most existing methods focus only on the API name or frequency of API and permission usage, neglecting key information such as the semantic context of APIs, which remains insufficient. In this paper, we propose a dynamic Android malware detection method based on quadruple sequence and a new data augmentation method, which includes a quadruple semantic chain for decomposing API to obtain semantic information and a new data augmentation method extracting additional software sequence information without disrupting user operations through dynamic analysis. Through quadruple decomposition, we get category, action, class and operation object of the API, so that we can fully mine the semantic information of the API and form a quadruple semantic chain. Through data augmentation, we improved the representation of API sequence information by concatenating identical software API sequences with the same window period. Our proposed model achieves an accuracy of 0.9163 and an F1-score of 0.9417 on a large dataset, which outperforms baselines significantly. We also performed ablation studies to demonstrate the effectiveness of our model.