用BERT模型分析应用描述，识别恶意软件，准确率提升10%。
BERTDetect: A Neural Topic Modelling Approach for Android Malware Detection
- 基于BERTopic提取应用描述中的语义主题
- 在真实数据集上实现比基线高10%的F1分数
- 适合安全研究者和移动设备防护开发者
如今网络访问主要通过移动设备进行，其中安卓系统占据重要市场份额，也因此成为恶意攻击的主要目标。尽管已有谷歌应用保护和杀毒软件等工具，新型及变种恶意软件仍持续渗透安卓设备。源代码分析虽有效，但因攻击者迅速弃用旧版本以逃避检测而受限。因此需要替代方法补充源码分析。以往研究通过应用描述聚类并结合API调用识别异常，但多依赖如LDA、k-means等传统技术，难以捕捉描述中的深层语义。本文提出BERTDetect，采用BERTopic神经主题建模方法，更有效地挖掘应用描述中的潜在主题。所得主题聚类更具一致性，能更好反映应用功能。实验表明，BERTDetect相较其他基线方法，在F1分数上实现约10%的相对提升。
原文摘要 · Abstract (English)
Web access today occurs predominantly through mobile devices, with Android representing a significant share of the mobile device market. This widespread usage makes Android a prime target for malicious attacks. Despite efforts to combat malicious attacks through tools like Google Play Protect and antivirus software, new and evolved malware continues to infiltrate Android devices. Source code analysis is effective but limited, as attackers quickly abandon old malware for new variants to evade detection. Therefore, there is a need for alternative methods that complement source code analysis. Prior research investigated clustering applications based on their descriptions and identified outliers in these clusters by API usage as malware. However, these works often used traditional techniques such as Latent Dirichlet Allocation (LDA) and k-means clustering, that do not capture the nuanced semantic structures present in app descriptions. To this end, in this paper, we propose BERTDetect, which leverages the BERTopic neural topic modelling to effectively capture the latent topics in app descriptions. The resulting topic clusters are comparatively more coherent than previous methods and represent the app functionalities well. Our results demonstrate that BERTDetect outperforms other baselines, achieving ~10% relative improvement in F1 score.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。