Detecting Android Malware With Pre-Existing Image Classification Neural Networks

Android malware detection has attracted increasing attention due to the rapid growth of mobile malware. However, running an in-cloud Android malware detection system usually incurs high hardware and bandwidth costs. This dilemma motivates us to develop a method to repurpose an in-cloud image-classification neural network to detect Android malware. Given an Android app, the proposed method first embeds its features into an image, skillfully perturbs the feature-embedded image, and then feeds the modified image into the in-cloud image classifier. The classifier's outputs are finally mapped into a malware detection result. In addition, two new techniques (perturbation hiding and group mapping) are proposed to reduce the risk of repurposing behavior being recognized and improve detection performance. Experiments show that our perturbations are usually imperceptible to humans, and our method outperforms both traditional machine learning-based detectors and deep learning-based detectors in detection performance.