A lightweight method for Android malware classification based on teacher assistant distillation

In recent years, the growing concern over mobile security and the associated risks posed by mobile malware have prompted an increased focus on utilizing deep learning models for analyzing Android application security. However, the expansion of deep learning model sizes results in an exponential growth of model parameters, demanding significant computing resources for execution. To address this challenge, we propose a lightweight Android malware detection method based on teacher-assistant-student knowledge distillation. Our method enables predicting on local clients, eliminating the need for cloud-base service interactions, and protecting user privacy. We visualize the binary file of the target Android application as an RGB three-channel color image, using ResNeSt50 as the teacher model, and compress it based on knowledge distillation. An assistant model is incorporated to address the issue of insufficient distillation resulting from the significant gap between the teacher and student models. Additionally, we integrate a split-attention mechanism to enhance the ability of the professor model to acquire deep features of malware images. We conduct experiments on Drebin and CICMalDroid 2020 datasets and the results show that the proposed method can ensure that the detection results of student model are more similar to those of the teacher model while reducing model complexity. Our method reduces the number of model parameters by 95% compare to the teacher model while maintaining accuracy. And the accuracy is improved by 0.63% compare to the traditional distillation method.