These labels were automatically added by AI and may be inaccurate. For details, see About Literature Database.
Abstract
The acceptance and widespread use of the Android operating system drew the
attention of both legitimate developers and malware authors, which resulted in
a significant number of benign and malicious applications available on various
online markets. Since the signature-based methods fall short for detecting
malicious software effectively considering the vast number of applications,
machine learning techniques in this field have also become widespread. In this
context, stating the acquired accuracy values in the contingency tables in
malware detection studies has become a popular and efficient method and enabled
researchers to evaluate their methodologies comparatively. In this study, we
wanted to investigate and emphasize the factors that may affect the accuracy
values of the models managed by researchers, particularly the disassembly
method and the input data characteristics. Firstly, we developed a model that
tackles the malware detection problem from a Natural Language Processing (NLP)
perspective using Long Short-Term Memory (LSTM). Then, we experimented with
different base units (instruction, basic block, method, and class) and
representations of source code obtained from three commonly used disassembling
tools (JEB, IDA, and Apktool) and examined the results. Our findings exhibit
that the disassembly method and different input representations affect the
model results. More specifically, the datasets collected by the Apktool
achieved better results compared to the other two disassemblers.