The Experts below are selected from a list of 2010 Experts worldwide ranked by ideXlab platform
Yunhao Liu - One of the best experts on this subject based on the ideXlab platform.
-
systematically landing machine learning onto market scale mobile malware detection
IEEE Transactions on Parallel and Distributed Systems, 2021Co-Authors: Liangyi Gong, Feng Qian, Hao Lin, Yunhao LiuAbstract:Despite being crucial to today’s mobile ecosystem, app markets have meanwhile become a natural, convenient malware delivery channel as they actually “lend credibility” to Malicious Apps. In the past few years, machine learning (ML) techniques have been widely explored for automated, robust malware detection, but till now we have not seen an ML-based malware detection solution applied at market scales. To systematically understand the real-world challenges, we conduct a collaborative study with T-Market, a popular Android app market that offers us large-scale ground-truth data. Our study illustrates that the key to successfully developing such systems is multifold, including feature selection and encoding , feature engineering and exposure , app analysis speed and efficacy , developer and user engagement , as well as ML model evolution . Failure in any of the above aspects could lead to the “wooden barrel effect” of the whole system. This article presents our judicious design choices and first-hand deployment experiences in building a practical ML-powered malware detection system. It has been operational at T-Market, using a single commodity server to check $\sim$ ∼ 12K Apps every day, and has achieved an overall precision of 98.9 percent and recall of 98.1 percent with an average per-app scan time of 0.9 minutes.
-
overlay based android malware detection at market scales systematically adapting to the new technological landscape
IEEE Transactions on Mobile Computing, 2021Co-Authors: Liangyi Gong, Hao Lin, Hongyi Wang, Yunhao LiuAbstract:Android overlay enables one app to draw over other Apps by creating an extra View layer atop the host View, which nevertheless can be exploited by Malicious Apps (malware) to attack users. To combat this threat, prior countermeasures concentrate on restricting the capabilities of overlays at the OS level while sacrificing overlays usability; recently, the overlay mechanism has been substantially updated to prevent a variety of attacks, which however can still be evaded by considerable adversaries. To address these shortcomings, a more pragmatic approach is to enable early detection of overlay-based malware during the app market review process, so that all the capabilities of overlays can stay unchanged. For this purpose, in this paper we first conduct a large-scale comparative study of overlay characteristics in benign and Malicious Apps, and then implement the OverlayChecker system to automatically detect overlay-based malware for one of the worlds largest Android app stores. In particular, we have made systematic efforts in feature engineering, UI exploration, emulation architecture, and run-time environment, thus maintaining high detection accuracy (97% precision and 97% recall) and short per-app scan time (1.7 minutes) with only two commodity servers, under an intensive workload of 10K newly submitted Apps per day.
-
experiences of landing machine learning onto market scale mobile malware detection
European Conference on Computer Systems, 2020Co-Authors: Liangyi Gong, Qi Alfred Chen, Feng Qian, Zifan Zhang, Zhiyun Qian, Hao Lin, Yunhao LiuAbstract:App markets, being crucial and critical for today's mobile ecosystem, have also become a natural malware delivery channel since they actually "lend credibility" to Malicious Apps. In the past decade, machine learning (ML) techniques have been explored for automated, robust malware detection. Unfortunately, to date, we have yet to see an ML-based malware detection solution deployed at market scales. To better understand the real-world challenges, we conduct a collaborative study with a major Android app market (T-Market) offering us large-scale ground-truth data. Our study shows that the key to successfully developing such systems is manifold, including feature selection/engineering, app analysis speed, developer engagement, and model evolution. Failure in any of the above aspects would lead to the "wooden barrel effect" of the entire system. We discuss our careful design choices as well as our first-hand deployment experiences in building such an ML-powered malware detection system. We implement our design and examine its effectiveness in the T-Market for over one year, using a single commodity server to vet ~ 10K Apps every day. The evaluation results show that this design achieves an overall precision of 98% and recall of 96% with an average per-app scan time of 1.3 minutes.
Liangyi Gong - One of the best experts on this subject based on the ideXlab platform.
-
systematically landing machine learning onto market scale mobile malware detection
IEEE Transactions on Parallel and Distributed Systems, 2021Co-Authors: Liangyi Gong, Feng Qian, Hao Lin, Yunhao LiuAbstract:Despite being crucial to today’s mobile ecosystem, app markets have meanwhile become a natural, convenient malware delivery channel as they actually “lend credibility” to Malicious Apps. In the past few years, machine learning (ML) techniques have been widely explored for automated, robust malware detection, but till now we have not seen an ML-based malware detection solution applied at market scales. To systematically understand the real-world challenges, we conduct a collaborative study with T-Market, a popular Android app market that offers us large-scale ground-truth data. Our study illustrates that the key to successfully developing such systems is multifold, including feature selection and encoding , feature engineering and exposure , app analysis speed and efficacy , developer and user engagement , as well as ML model evolution . Failure in any of the above aspects could lead to the “wooden barrel effect” of the whole system. This article presents our judicious design choices and first-hand deployment experiences in building a practical ML-powered malware detection system. It has been operational at T-Market, using a single commodity server to check $\sim$ ∼ 12K Apps every day, and has achieved an overall precision of 98.9 percent and recall of 98.1 percent with an average per-app scan time of 0.9 minutes.
-
overlay based android malware detection at market scales systematically adapting to the new technological landscape
IEEE Transactions on Mobile Computing, 2021Co-Authors: Liangyi Gong, Hao Lin, Hongyi Wang, Yunhao LiuAbstract:Android overlay enables one app to draw over other Apps by creating an extra View layer atop the host View, which nevertheless can be exploited by Malicious Apps (malware) to attack users. To combat this threat, prior countermeasures concentrate on restricting the capabilities of overlays at the OS level while sacrificing overlays usability; recently, the overlay mechanism has been substantially updated to prevent a variety of attacks, which however can still be evaded by considerable adversaries. To address these shortcomings, a more pragmatic approach is to enable early detection of overlay-based malware during the app market review process, so that all the capabilities of overlays can stay unchanged. For this purpose, in this paper we first conduct a large-scale comparative study of overlay characteristics in benign and Malicious Apps, and then implement the OverlayChecker system to automatically detect overlay-based malware for one of the worlds largest Android app stores. In particular, we have made systematic efforts in feature engineering, UI exploration, emulation architecture, and run-time environment, thus maintaining high detection accuracy (97% precision and 97% recall) and short per-app scan time (1.7 minutes) with only two commodity servers, under an intensive workload of 10K newly submitted Apps per day.
-
experiences of landing machine learning onto market scale mobile malware detection
European Conference on Computer Systems, 2020Co-Authors: Liangyi Gong, Qi Alfred Chen, Feng Qian, Zifan Zhang, Zhiyun Qian, Hao Lin, Yunhao LiuAbstract:App markets, being crucial and critical for today's mobile ecosystem, have also become a natural malware delivery channel since they actually "lend credibility" to Malicious Apps. In the past decade, machine learning (ML) techniques have been explored for automated, robust malware detection. Unfortunately, to date, we have yet to see an ML-based malware detection solution deployed at market scales. To better understand the real-world challenges, we conduct a collaborative study with a major Android app market (T-Market) offering us large-scale ground-truth data. Our study shows that the key to successfully developing such systems is manifold, including feature selection/engineering, app analysis speed, developer engagement, and model evolution. Failure in any of the above aspects would lead to the "wooden barrel effect" of the entire system. We discuss our careful design choices as well as our first-hand deployment experiences in building such an ML-powered malware detection system. We implement our design and examine its effectiveness in the T-Market for over one year, using a single commodity server to vet ~ 10K Apps every day. The evaluation results show that this design achieves an overall precision of 98% and recall of 96% with an average per-app scan time of 1.3 minutes.
Hao Lin - One of the best experts on this subject based on the ideXlab platform.
-
systematically landing machine learning onto market scale mobile malware detection
IEEE Transactions on Parallel and Distributed Systems, 2021Co-Authors: Liangyi Gong, Feng Qian, Hao Lin, Yunhao LiuAbstract:Despite being crucial to today’s mobile ecosystem, app markets have meanwhile become a natural, convenient malware delivery channel as they actually “lend credibility” to Malicious Apps. In the past few years, machine learning (ML) techniques have been widely explored for automated, robust malware detection, but till now we have not seen an ML-based malware detection solution applied at market scales. To systematically understand the real-world challenges, we conduct a collaborative study with T-Market, a popular Android app market that offers us large-scale ground-truth data. Our study illustrates that the key to successfully developing such systems is multifold, including feature selection and encoding , feature engineering and exposure , app analysis speed and efficacy , developer and user engagement , as well as ML model evolution . Failure in any of the above aspects could lead to the “wooden barrel effect” of the whole system. This article presents our judicious design choices and first-hand deployment experiences in building a practical ML-powered malware detection system. It has been operational at T-Market, using a single commodity server to check $\sim$ ∼ 12K Apps every day, and has achieved an overall precision of 98.9 percent and recall of 98.1 percent with an average per-app scan time of 0.9 minutes.
-
overlay based android malware detection at market scales systematically adapting to the new technological landscape
IEEE Transactions on Mobile Computing, 2021Co-Authors: Liangyi Gong, Hao Lin, Hongyi Wang, Yunhao LiuAbstract:Android overlay enables one app to draw over other Apps by creating an extra View layer atop the host View, which nevertheless can be exploited by Malicious Apps (malware) to attack users. To combat this threat, prior countermeasures concentrate on restricting the capabilities of overlays at the OS level while sacrificing overlays usability; recently, the overlay mechanism has been substantially updated to prevent a variety of attacks, which however can still be evaded by considerable adversaries. To address these shortcomings, a more pragmatic approach is to enable early detection of overlay-based malware during the app market review process, so that all the capabilities of overlays can stay unchanged. For this purpose, in this paper we first conduct a large-scale comparative study of overlay characteristics in benign and Malicious Apps, and then implement the OverlayChecker system to automatically detect overlay-based malware for one of the worlds largest Android app stores. In particular, we have made systematic efforts in feature engineering, UI exploration, emulation architecture, and run-time environment, thus maintaining high detection accuracy (97% precision and 97% recall) and short per-app scan time (1.7 minutes) with only two commodity servers, under an intensive workload of 10K newly submitted Apps per day.
-
experiences of landing machine learning onto market scale mobile malware detection
European Conference on Computer Systems, 2020Co-Authors: Liangyi Gong, Qi Alfred Chen, Feng Qian, Zifan Zhang, Zhiyun Qian, Hao Lin, Yunhao LiuAbstract:App markets, being crucial and critical for today's mobile ecosystem, have also become a natural malware delivery channel since they actually "lend credibility" to Malicious Apps. In the past decade, machine learning (ML) techniques have been explored for automated, robust malware detection. Unfortunately, to date, we have yet to see an ML-based malware detection solution deployed at market scales. To better understand the real-world challenges, we conduct a collaborative study with a major Android app market (T-Market) offering us large-scale ground-truth data. Our study shows that the key to successfully developing such systems is manifold, including feature selection/engineering, app analysis speed, developer engagement, and model evolution. Failure in any of the above aspects would lead to the "wooden barrel effect" of the entire system. We discuss our careful design choices as well as our first-hand deployment experiences in building such an ML-powered malware detection system. We implement our design and examine its effectiveness in the T-Market for over one year, using a single commodity server to vet ~ 10K Apps every day. The evaluation results show that this design achieves an overall precision of 98% and recall of 96% with an average per-app scan time of 1.3 minutes.
Qi Alfred Chen - One of the best experts on this subject based on the ideXlab platform.
-
experiences of landing machine learning onto market scale mobile malware detection
European Conference on Computer Systems, 2020Co-Authors: Liangyi Gong, Qi Alfred Chen, Feng Qian, Zifan Zhang, Zhiyun Qian, Hao Lin, Yunhao LiuAbstract:App markets, being crucial and critical for today's mobile ecosystem, have also become a natural malware delivery channel since they actually "lend credibility" to Malicious Apps. In the past decade, machine learning (ML) techniques have been explored for automated, robust malware detection. Unfortunately, to date, we have yet to see an ML-based malware detection solution deployed at market scales. To better understand the real-world challenges, we conduct a collaborative study with a major Android app market (T-Market) offering us large-scale ground-truth data. Our study shows that the key to successfully developing such systems is manifold, including feature selection/engineering, app analysis speed, developer engagement, and model evolution. Failure in any of the above aspects would lead to the "wooden barrel effect" of the entire system. We discuss our careful design choices as well as our first-hand deployment experiences in building such an ML-powered malware detection system. We implement our design and examine its effectiveness in the T-Market for over one year, using a single commodity server to vet ~ 10K Apps every day. The evaluation results show that this design achieves an overall precision of 98% and recall of 96% with an average per-app scan time of 1.3 minutes.
-
understanding and detecting overlay based android malware at market scales
International Conference on Mobile Systems Applications and Services, 2019Co-Authors: Zhenhua Li, Qi Alfred Chen, Christo Wilson, Tianyin Xu, Ennan Zhai, Yong LiAbstract:As a key UI feature of Android, overlay enables one app to draw over other Apps by creating an extra View layer on top of the host View. While greatly facilitating user interactions with multiple Apps at the same time, it is often exploited by Malicious Apps (malware) to attack users. To combat this threat, prior countermeasures concentrate on restricting the capabilities of overlays at the OS level, while barely seeing adoption by Android due to the concern of sacrificing overlays' usability. To address this dilemma, a more pragmatic approach is to enable the early detection of overlay-based malware at the app market level during the app review process, so that all the capabilities of overlays can stay unchanged. Unfortunately, little has been known about the feasibility and effectiveness of this approach for lack of understanding of Malicious overlays in the wild. To fill this gap, in this paper we perform the first large-scale comparative study of overlay characteristics in benign and Malicious Apps using static and dynamic analyses. Our results reveal a set of suspicious overlay properties strongly correlated with the malice of Apps, including several novel features. Guided by the study insights, we build OverlayChecker, a system that is able to automatically detect overlay-based malware at market scales. OverlayChecker has been adopted by one of the world's largest Android app stores to check around 10K newly submitted Apps per day. It can efficiently (within 2 minutes per app) detect nearly all (96%) overlay-based malware using a single commodity server.
Yong Li - One of the best experts on this subject based on the ideXlab platform.
-
understanding and detecting overlay based android malware at market scales
International Conference on Mobile Systems Applications and Services, 2019Co-Authors: Zhenhua Li, Qi Alfred Chen, Christo Wilson, Tianyin Xu, Ennan Zhai, Yong LiAbstract:As a key UI feature of Android, overlay enables one app to draw over other Apps by creating an extra View layer on top of the host View. While greatly facilitating user interactions with multiple Apps at the same time, it is often exploited by Malicious Apps (malware) to attack users. To combat this threat, prior countermeasures concentrate on restricting the capabilities of overlays at the OS level, while barely seeing adoption by Android due to the concern of sacrificing overlays' usability. To address this dilemma, a more pragmatic approach is to enable the early detection of overlay-based malware at the app market level during the app review process, so that all the capabilities of overlays can stay unchanged. Unfortunately, little has been known about the feasibility and effectiveness of this approach for lack of understanding of Malicious overlays in the wild. To fill this gap, in this paper we perform the first large-scale comparative study of overlay characteristics in benign and Malicious Apps using static and dynamic analyses. Our results reveal a set of suspicious overlay properties strongly correlated with the malice of Apps, including several novel features. Guided by the study insights, we build OverlayChecker, a system that is able to automatically detect overlay-based malware at market scales. OverlayChecker has been adopted by one of the world's largest Android app stores to check around 10K newly submitted Apps per day. It can efficiently (within 2 minutes per app) detect nearly all (96%) overlay-based malware using a single commodity server.