How Can We Craft Large-Scale Android Malware? An Automated Poisoning Attack

Android malware, is one of the most serious threats to mobile security. Today, machine learning-based approach is one of the most promising approaches in detecting Android malware. However, our previous experiments show that sophisticated attackers can craft large-scale Android malware to pollute training data and pose an automated poisoning attack on machine learning-based malware detection systems (e.g., DREBIN, DROIDAPIMINER, STORMDROID, and MAMADROID), and eventually mislead the detection tools. We further examine how machine learning classifiers can be mislead under four different attack models and significantly reduce detection accuracy. Apart from Android malware, to better protect mobile devices, we also discuss a general threat model of Android devices to investigate the capabilities of different attackers.