Heng Li

The high-quality labeled dataset is crucial for building effective Android malware detection models. However, widely used automated labeling systems (e.g., antivirus services) are often not stable enough and may introduce label noise. In this paper, we identify and analyze two types of noise: RDMnoise and IDNnoise . RDMnoise is introduced by the labeling system randomly flipping labels, exhibiting class symmetry. In contrast, IDNnoise arises primarily because engines tend to misclassify obfuscated software as malware, exhibiting class dependency. Both types of noise can bias the training process of malware detection systems, thereby affecting the overall performance of the model. To combat these two types of noise of Android malware detection, we propose a lightweight training framework called CoNoMAD , which combines model-level and data-level approaches to jointly mitigate label noise. Specifically, to overcome the uncertainty introduced by noisy labels for model training, we assist the training by seeking more certainty in the supervisory information from both the model and data levels. On the model level, CoNoMAD relies on an under-trained model. The intuition behind this is to reduce the model's sensitivity to noisy labels by limiting its capacity to overfit. On the data level, CoNoMAD employs a clustering algorithm to mitigate the impact of noise on data distribution by identifying and grouping similar data points. Through auxiliary training on these two levels, CoNoMAD effectively mitigates the negative impact of label noise on models in complex scenarios. We validate the performance of CoNoMAD on 25 datasets with varying noise ratios, including the RDMnoise dataset, the IDNnoise dataset, and a mixed dataset containing both types of noise. Experiments show CoNoMAD improves detection performance by 50.89%, 24.30%, and 29.34% on popular malware detectors, under the RDMnoise , IDNnoise , and Mixed Noise. Compared to state-of-the-art methods, CoNoMAD achieves higher detection performance and training efficiency. Finally, this study calls for more attention to the impact of label noise on Android malware detection.

Recent advances in machine learning have enabled highly effective ciphertext-based cryptographic algorithm identification, posing a potential threat to encrypted communication. Inspired by adversarial example techniques, we present CSPM (Class-Specific Perturbation Mask Generation), a novel adversarial-defense framework that enhances ciphertext unidentifiability through misleading machine-learning-based cipher classifiers. CPSM constructs lightweight, reversible bit-level perturbations that alter statistical ciphertext features without affecting legitimate decryption. The method leverages class prototypes to capture representative bit-distribution patterns for each cryptographic algorithm and integrates two complementary mechanisms—mimicry-based perturbing, which steers ciphertexts toward similar cipher classes, and distortion-based perturbing, which disrupts distinctive statistical traits—through a ranking-based greedy search. Extensive experiments on seven widely used cryptographic algorithms and fifteen NIST statistical feature configurations demonstrate that CSPM consistently reduces algorithm-identification accuracy by over 25%. These results confirm that perturbation position selection, rather than magnitude, dominates attack efficacy. CSPM provides a practical defense mechanism, offering a new perspective for safeguarding encrypted communications against statistical and machine-learning-based traffic analysis.

Machine learning-based Android malware detection (AMD) models require abundant data for training robust app classifiers, creating vulnerability to poisoning attacks. Attackers inject poisoned samples into Android app markets, leading to the insertion of a backdoor into the model upon adoption in the training process. Subsequently, attackers can generate evasive malware by embedding a backdoor trigger in malware samples. Currently, research on backdoor attacks towards AMD has just begun to emerge. Existing attacks produce a fixed trigger and apply it to various malware. Once the trigger is discovered by static analysis methods (e.g., software similarity analysis), however, multiple malware carrying this trigger will be simultaneously exposed. To diversify the trigger, we propose an APK-Specific Backdoor Attack algorithm (ASBA), which trains a generative adversarial network to generate a specific trigger for every malware sample. Moreover, ASBA manages to make the generated triggers as different as possible, in order to further reduce the likelihood of malware being collectively captured. Extensive experiments have demonstrated that ASBA achieves a 94.6% average attack success rate (ASR) on three datasets, five feature extraction methods and three classification models. Furthermore, compared to state-of-the-art poisoning attack algorithms, ASBA produces more diverse and more effective triggers.

Function Call Graph (FCG) based Android malware detectors can achieve satisfactory detection performance but are vulnerable to adversarial examples (AEs). Existing adversarial attacks generate AEs separately and specifically for different APKs (termed as APK-specific attacks), resulting in significant computational overhead and limited attack efficiency. In this paper, we propose an APK-Agnostic Adversarial Attack Method (termed as A4M) for FCG-based Android malware detection, enabling the deployment of large-scale malware adversarial examples. Meanwhile, this perturbation can also greatly accelerate existing APK-specific attacks. We conduct extensive experiments to evaluate the effectiveness and efficiency of A4M. A4M achieves an average attack success rate (ASR) of 85.17% on 7 target detectors (built with MAMADroid, APIGraph and GNN), significantly surpassing the state-of-the-art attack MalPatch by 28.17%. Experiments also demonstrate A4M can markedly accelerate the APK-specific attacks HIV_CW, HIV_JSMA and DQN, reducing about 88 queries per adversarial example.

With the widespread application of machine learning-based Android malware detection methods, building a high-quality dataset has become increasingly important. Existing large-scale datasets are mostly annotated with VirusTotal by aggregating the decisions of antivirus engines, and most of them indiscriminately accept the decisions of all engines. In reality, however, these engines have different capabilities in detecting malware, especially those that have been obfuscated. Previous research has revealed that code obfuscation degrades the detection performance of these engines to varying degrees. This makes us believe that using all engines indiscriminately is unreasonable for dataset annotation. Therefore, in this paper, we first conduct a data-driven evaluation to confirm the negative effects of code obfuscation on engine-based dataset annotation. To gain a deeper understanding of the reasons behind this phenomenon, we evaluate the availability, effectiveness and robustness of every engine under various code obfuscation techniques. Then we categorize the engines and select a set of obfuscation-robust engines. Finally, we conduct comprehensive experiments to verify the effectiveness of the selected engines for dataset annotation. Our experiments show that when 50% obfuscated samples are mixed into the training set, on the classic malware detectors Drebin and Malscan, using our selected engines can effectively improve detection performance by 15.21% and 19.23%, respectively, compared to using all the engines.

Adversarial patches can mislead object detectors to produce erroneous predictions. To defend against adversarial patches, one can take two types of protections on the model side, including modifying the detector itself (e.g., adversarial training) or attaching a new model in front of the detector. However, the former often deteriorates clean performance of detectors, and the latter may have high deployment costs caused by too many training parameters. Inspired by the phenomenon of "bone hyperplasia" in human bodies, we present a novel model-side adversarial patch defense, called HARP (Hyperplasia based Adversarial Patch defense). Just as bone hyperplasia can enhance bone strength and skeletal stability, the hyperostosia of detectors can also help to resist adversarial patches. Following this idea, HARP chooses to improve adversarial robustness by "growing" lightweight CNN modules (i.e., hyperplasia modules) on the pre-trained object detectors. We conduct extensive experiments on the PASCAL VOC and COCO datasets to compare HARP with the data-side defense JPEG and the model-side defenses adversarial training, SAC and FNC. Experimental results show that HARP provides excellent defense against adversarial patches while maintaining clean performance, outperforming the compared defense methods. Under PGD-based adaptive attacks, HARP surpasses the recently proposed defense method SAC by 12.5% in mean average precision (mAP) on PASCAL VOC, and 13.2% on COCO dataset. In addition, experiments confirm that the increase in model inference time caused by HARP is almost negligible.