R2-D2: ColoR-inspired Convolutional NeuRal Network (CNN)-based AndroiD Malware Detections

2017/05/12 by TonTon Hsien-De Huang, Huang, TonTon Hsien-De, Hung‐Yu Kao +2 · 38 citations
Computer Science · #Advanced Malware Detection Techniques #Android (operating system) #Android malware #Artificial intelligence #Bytecode #Computer science #Convolutional neural network #Deep learning #Digital and Cyber Forensics #Feature extraction #Machine learning #Malware #Network Security and Intrusion Detection #Operating system #Pattern recognition (psychology) #RGB color model #cs.AI #cs.CR

paper · pdf · doi:10.48550/arxiv.1705.04448

published in arXiv (Cornell University) (Cornell University) · Verison 2018/11/15, IEEE BigData 2018, Seattle, WA, USA, Dec 10-13, 2018. (Accepted)

openalex publication_date 2017/05/12 · arxiv created 2018/11/15 · arxiv updated 2018/11/16 · openalex created_date 2025/10/10 · openalex updated_date 2026/08/05

Abstract

The influence of Deep Learning on image identification and natural language processing has attracted enormous attention globally. The convolution neural network that can learn without prior extraction of features fits well in response to the rapid iteration of Android malware. The traditional solution for detecting Android malware requires continuous learning through pre-extracted features to maintain high performance of identifying the malware. In order to reduce the manpower of feature engineering prior to the condition of not to extract pre-selected features, we have developed a coloR-inspired convolutional neuRal networks (CNN)-based AndroiD malware Detection (R2-D2) system. The system can convert the bytecode of classes.dex from Android archive file to rgb color code and store it as a color image with fixed size. The color image is input to the convolutional neural network for automatic feature extraction and training. The data was collected from Jan. 2017 to Aug 2017. During the period of time, we have collected approximately 2 million of benign and malicious Android apps for our experiments with the help from our research partner Leopard Mobile Inc. Our experiment results demonstrate that the proposed system has accurate security analysis on contracts. Furthermore, we keep our research results and experiment materials on http://R2D2.TWMAN.ORG.

Citations

• Very Deep Convolutional Networks for Large-Scale Image Recognition

Cited by

• LLM-Driven Feature-Level Adversarial Attacks on Android Malware Detectors
• Signal-Based Malware Classification Using 1D CNNs
• Hunting the Ethereum Smart Contract: Color-inspired Inspection of Potential Attacks
• Deep Learning for Anomaly Detection: A Survey
• PhishingHook: Catching Phishing Ethereum Smart Contracts leveraging EVM Opcodes
• Comparison of Multiple Classifiers for Android Malware Detection with Emphasis on Feature Insights Using CICMalDroid 2020 Dataset

Related

• Integrating APK Image and Text Data for Enhanced Threat Detection: A Multimodal Deep Learning Approach to Android Malware
• MalVis: A Large-Scale Image-Based Framework and Dataset for Advancing Android Malware Classification
• DexRay: A Simple, yet Effective Deep Learning Approach to Android Malware Detection based on Image Representation of Bytecode
• Improving Android Malware Detection Through Data Augmentation Using Wasserstein Generative Adversarial Networks
• Android-COCO: Android Malware Detection with Graph Neural Network for Byte- and Native-Code