通过代码、上下文和库调用三视角融合，提升安卓应用行为检测准确率。
BinCtx: Multi-Modal Representation Learning for Robust Android App Behavior Detection
- 融合字节码图像、触发上下文与第三方库调用三视图进行表征学习
- 在真实数据上达到94.73%宏F1，比基线高至少14.92%
- 对商业混淆和对抗样本有强鲁棒性，适合安全检测场景
移动应用市场拥有数百万应用，但诸如干扰广告、非法跳转、支付欺骗等不良行为难以发现，因其常不依赖权限保护的API，且可通过界面或元数据修改进行伪装。本文提出BINCTX，一种从三个维度构建应用多模态表征的学习方法：(i) 全局字节码图像视图，捕捉代码语义与家族模式；(ii) 上下文视图（包括动作、组件、声明权限、URL/IP常量），指示行为触发方式；(iii) 第三方库使用视图，汇总跨组件调用路径中的调用频率。三视图嵌入后融合，训练上下文感知分类器。在真实恶意与良性应用数据集上，BINCTX取得94.73%的宏F1，优于强基线至少14.92%。在商业混淆后仍保持84% F1，且对对抗样本的抵抗力优于现有仅基于字节码的方法。
原文摘要 · Abstract (English)
Mobile app markets host millions of apps, yet undesired behaviors (e.g., disruptive ads, illegal redirection, payment deception) remain hard to catch because they often do not rely on permission-protected APIs and can be easily camouflaged via UI or metadata edits. We present BINCTX, a learning approach that builds multi-modal representations of an app from (i) a global bytecode-as-image view that captures code-level semantics and family-style patterns, (ii) a contextual view (manifested actions, components, declared permissions, URL/IP constants) indicating how behaviors are triggered, and (iii) a third-party-library usage view summarizing invocation frequencies along inter-component call paths. The three views are embedded and fused to train a contextual-aware classifier. On real-world malware and benign apps, BINCTX attains a macro F1 of 94.73%, outperforming strong baselines by at least 14.92%. It remains robust under commercial obfuscation (F1 84% post-obfuscation) and is more resistant to adversarial samples than state-of-the-art bytecode-only systems.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。