Android is the most popular mobile operating system with a market share of over 80%. Due to its popularity and also its open source nature, Android is now the platform most targeted by malware, creating an urgent need for effective defense mechanisms to protect Android-enabled devices. In this dissertation, we present a novel characterization and machine learning method for Android malware classification. We first present a method of dynamically analyzing and classifying Android applications as either malicious or benign based on their execution behaviors. We invent novel graph-based methods of characterizing an application's execution behavior that are inspired by traditional vector-based characterization methods. We show evidence that our graph-based techniques are superior to vector-based techniques for the problem of classifying malicious and benign applications. We also augment our dynamic analysis characterization method with a static analysis method which we call HADM, Hybrid Analysis for Detection of Malware. We first extract static and dynamic information, and convert this information into vector-based representations. It has been shown that combining advanced features derived by deep learning with the original features provides significant gains. Therefore, we feed each of the original dynamic and static feature vector sets to a Deep Neural Network (DNN) which outputs a new set of features. These features are then concatenated with the original features to construct DNN vector sets. Different kernels are then applied onto the DNN vector sets. We also convert the dynamic information into graph-based representations and apply graph kernels onto the graph sets. Learning results from various vector and graph feature sets are combined using hierarchical Multiple Kernel Learning (MKL) to build a final hybrid classifier. Graph-based characterization methods and their associated machine learning algorithm tend to yield better accuracy for the problem of malware detection. However, the graph-based machine learning techniques we use, i.e., graph kernels, are computationally expensive. Therefore, we also study the parallelization of graph kernels in this dissertation. We first present a fast sequential implementation of the graph kernel. Then, we explore two different parallelization schemes on the CPU and four different implementations on the GPU. After analyzing the advantages of each, we present a hybrid parallel scheme, which dynamically chooses the best parallel implementation to use based on characteristics of the problem. In the last chapter of this dissertation, we explore parallelizing deep learning on a novel architecture design, which may be prevalent in the future. Parallelization of deep learning methods has been studied on traditional CPU and GPU clusters. However, the emergence of Processing In Memory (PIM) with die-stacking technology presents an opportunity to speed up deep learning computation and reduce energy consumption by providing low-cost high-bandwidth memory accesses. PIM uses 3D die stacking to move computations closer to memory and therefore reduce data movement overheads. In this dissertation, we study the parallelization of deep learning methods on a system with multiple PIM devices. We select three representative deep learning neural network layers: the convolutional, pooling, and fully connected layers, and parallelize them using different schemes targeted to PIM devices.

The authors develop a malware fingerprinting framework to cover accurate android malware detection and family attribution in this book. The authors emphasize the following: (1) the scalability over a large malware corpus; (2) the resiliency to common obfuscation techniques; (3) the portability over different platforms and architectures. First, the authors propose an approximate fingerprinting technique for android packaging that captures the underlying static structure of the android applications in the context of bulk and offline detection at the app-market level. This book proposes a malware clustering framework to perform malware clustering by building and partitioning the similarity network of malicious applications on top of this fingerprinting technique. Second, the authors propose an approximate fingerprinting technique that leverages dynamic analysis and natural language processing techniques to generate Android malware behavior reports. Based on this fingerprinting technique, the authors propose a portable malware detection framework employing machine learning classification. Third, the authors design an automatic framework to produce intelligence about the underlying malicious cyber-infrastructures of Android malware. The authors then leverage graph analysis techniques to generate relevant intelligence to identify the threat effects of malicious Internet activity associated with android malware. The authors elaborate on an effective android malware detection system, in the online detection context at the mobile device level. It is suitable for deployment on mobile devices, using machine learning classification on method call sequences. Also, it is resilient to common code obfuscation techniques and adaptive to operating systems and malware change overtime, using natural language processing and deep learning techniques. Researchers working in mobile and network security, machine learning and pattern recognition will find this book useful as a reference. Advanced-level students studying computer science within these topic areas will purchase this book as well.

​This book is focused on the use of deep learning (DL) and artificial intelligence (AI) as tools to advance the fields of malware detection and analysis. The individual chapters of the book deal with a wide variety of state-of-the-art AI and DL techniques, which are applied to a number of challenging malware-related problems. DL and AI based approaches to malware detection and analysis are largely data driven and hence minimal expert domain knowledge of malware is needed. This book fills a gap between the emerging fields of DL/AI and malware analysis. It covers a broad range of modern and practical DL and AI techniques, including frameworks and development tools enabling the audience to innovate with cutting-edge research advancements in a multitude of malware (and closely related) use cases.

Android is popular mobile operating system and there are multiple marketplaces for android applications. Most of these market places allow applications to be signed using self-signed certificates. Due to this practice there exists little or very limited control over the kind of applications that are being distributed. Also advancement of android root kits is making it increasingly easier to repackage existing android applications with malicious code. Conventional signature based techniques fail to detect these malwares. So detection and classification of android malwares is a very difficult problem to solve.

Android malware is a growing threat, coinciding with the increasing adoption of the Android platform. Malware detection methods used to maintain user privacy and system integrity are increasingly becoming the subject of research. Many new methods studied employ learning algorithms to detect malicious programs. This study investigates the use of byte and opcode frequency features as inputs for tree-based machine learning methods. The algorithm is optimized to reduce overfitting given input hyperparameter combinations and is tuned using cross-validation procedures. Lastly, the study deliberates on possible avenues for future research to gather more concrete evidence for the efficacy and cost-effectiveness of such a system in a productive environment, emphasizing the need for more strenuous testing processes.

This is book offers in-depth analysis of security vulnerabilities in different mobile operating systems. It provides methodology and solutions for handling Android malware and vulnerabilities and transfers the latest knowledge in machine learning and deep learning models towards this end. Further, it presents a comprehensive analysis of software vulnerabilities based on different technical parameters such as causes, severity, techniques, and software systems’ type. Moreover, the book also presents the current state of the art in the domain of software threats and vulnerabilities. This would help analyze various threats that a system could face, and subsequently, it could guide the securityengineer to take proactive and cost-effective countermeasures. Security threats are escalating exponentially, thus posing a serious challenge to mobile platforms. Android and iOS are prominent due to their enhanced capabilities and popularity among users. Therefore, it is important to compare these two mobile platforms based on security aspects. Android proved to be more vulnerable compared to iOS. The malicious apps can cause severe repercussions such as privacy leaks, app crashes, financial losses (caused by malware triggered premium rate SMSs), arbitrary code installation, etc. Hence, Android security is a major concern amongst researchers as seen in the last few years. This book provides an exhaustive review of all the existing approaches in a structured format. The book also focuses on the detection of malicious applications that compromise users' security and privacy, the detection performance of the different program analysis approach, and the influence of different input generators during static and dynamic analysis on detection performance. This book presents a novel method using an ensemble classifier scheme for detecting malicious applications, which is less susceptible to the evolution of the Android ecosystem and malware compared to previous methods. The book also introduces an ensemble multi-class classifier scheme to classify malware into known families. Furthermore, we propose a novel framework of mapping malware to vulnerabilities exploited using Android malware’s behavior reports leveraging pre-trained language models and deep learning techniques. The mapped vulnerabilities can then be assessed on confidentiality, integrity, and availability on different Android components and sub-systems, and different layers.