论文标题
旨在准确标记Android应用程序以进行可靠的恶意软件检测
Towards Accurate Labeling of Android Apps for Reliable Malware Detection
论文作者
论文摘要
在培训新开发的恶意软件检测方法时，研究人员依靠基于阈值的标签策略来解释在线平台（例如Virustotal）提供的扫描报告。该平台的动态性使这些标记策略在长时间内无法维持，从而导致标签不准确。使用不准确的应用程序来训练和评估恶意软件检测方法会大大破坏其结果的可靠性，从而导致驳回原本有希望的检测方法，或者采用本质上不足的方法。通过手动分析和缺乏可靠的替代方案产生准确标签的不可行性迫使研究人员将Virustotal用于标签应用程序。在论文中，我们以两种方式解决了这个问题。首先，我们揭示了Virustotal动态性的各个方面及其如何影响基于阈值的标签策略，并提供有关如何使用这些标记策略的可行见解。其次，我们通过（a）识别该平台应避免的病毒限制来激励替代平台的实现，以及（b）提出一个如何构建此类平台以减轻Virustotal的限制的体系结构。
In training their newly-developed malware detection methods, researchers rely on threshold-based labeling strategies that interpret the scan reports provided by online platforms, such as VirusTotal. The dynamicity of this platform renders those labeling strategies unsustainable over prolonged periods, which leads to inaccurate labels. Using inaccurately labeled apps to train and evaluate malware detection methods significantly undermines the reliability of their results, leading to either dismissing otherwise promising detection approaches or adopting intrinsically inadequate ones. The infeasibility of generating accurate labels via manual analysis and the lack of reliable alternatives force researchers to utilize VirusTotal to label apps. In the paper, we tackle this issue in two manners. Firstly, we reveal the aspects of VirusTotal's dynamicity and how they impact threshold-based labeling strategies and provide actionable insights on how to use these labeling strategies given VirusTotal's dynamicity reliably. Secondly, we motivate the implementation of alternative platforms by (a) identifying VirusTotal limitations that such platforms should avoid, and (b) proposing an architecture of how such platforms can be constructed to mitigate VirusTotal's limitations.
