{"authors":[{"id":"orcid_______::a843e0bc36e535fa1789daa47c73c811","fullName":"Francesco Mercaldo","name":null,"surname":null,"rank":1,"pid":{"id":{"scheme":"orcid","value":"0000-0002-9425-1657"},"provenance":null}},{"id":"orcid_______::ad14d685d6b12cb35628fa85f202dc7b","fullName":"Giovanni Ciaramella","name":null,"surname":null,"rank":2,"pid":{"id":{"scheme":"orcid","value":"0009-0002-9512-0621"},"provenance":null}},{"id":null,"fullName":"Antonella Santone","name":null,"surname":null,"rank":3,"pid":{"id":{"scheme":"orcid_pending","value":"0000-0002-2634-4456"},"provenance":null}},{"id":"orcid_______::2e1e04dcd02fa9e93a7cea4862c3b04d","fullName":"Fabio Martinelli","name":null,"surname":null,"rank":4,"pid":{"id":{"scheme":"orcid","value":"0000-0002-6721-9395"},"provenance":null}}],"openAccessColor":null,"publiclyFunded":false,"eoscIfGuidelines":null,"type":"publication","language":{"code":"und","label":"Undetermined"},"countries":[{"code":"IT","label":"Italy","provenance":null}],"subjects":[{"subject":{"scheme":"FOS","value":"0202 electrical engineering, electronic engineering, information engineering"},"provenance":null},{"subject":{"scheme":"keyword","value":"Android; classification; deep learning; explainability; malware; mobile; obfuscation; security"},"provenance":null},{"subject":{"scheme":"FOS","value":"02 engineering and technology"},"provenance":null}],"mainTitle":"Obfuscated Mobile Malware Detection by Means of Dynamic Analysis and Explainable Deep Learning","subTitle":null,"descriptions":["With the growth of the mobile market, malicious applications represent a risk to the security of the users. To mitigate this aspect, researchers proposed different techniques to spot and identify unsafe software placed on the market. On the other hand, malicious writers started to develop ever more sophisticated strategies to hide malicious payloads, in particular through the adoption of obfuscation techniques. The latter consists of hiding the behavior and purpose of malware from antimalware. In this paper, we propose and design a method aimed to detect obfuscated malware. The proposed method builds images directly from system call traces obtained from legitimate, malicious, and obfuscated Android applications. In addition, to show that dynamic analysis and deep learning can build resilient models we propose two experiments using a convolutional neural network. In the first experiment, we train and test the model using a dataset composed of malware, while in the second we train the model using the malware dataset but the model is evaluated using a dataset composed of obfuscated malware. Finally, we analyze the malware and obfuscated detection models from the point of view of explainability using two different class activation mapping algorithms, to understand whether the model predictions can be considered resilient."],"publicationDate":"2023-08-29","publisher":"ACM","embargoEndDate":null,"sources":["Crossref","Proceedings of the 18th International Conference on Availability, Reliability and Security"],"formats":null,"contributors":null,"coverages":null,"bestAccessRight":{"code":"c_14cb","label":"CLOSED","scheme":"http://vocabularies.coar-repositories.org/documentation/access_rights/"},"container":{"name":"Proceedings of the 18th International Conference on Availability, Reliability and Security","issnPrinted":null,"issnOnline":null,"issnLinking":null,"ep":"10","iss":null,"sp":"1","vol":null,"edition":null,"conferencePlace":null,"conferenceDate":null},"documentationUrls":null,"codeRepositoryUrl":null,"programmingLanguage":null,"contactPeople":null,"contactGroups":null,"tools":null,"size":null,"version":null,"geoLocations":null,"id":"doi_dedup___::a68f3fa6e34dcae0fbbb5bd4bb023e8c","originalIds":["10.1145/3600160.3605037","10.1145/3600160","50|doiboost____|a68f3fa6e34dcae0fbbb5bd4bb023e8c","50|dblp________::183e0e661c7deeb648fa610b9127916a","50|od______3981::7a94725e52b822b1007564e9d5ed75d5","oai:iris.unimol.it:11695/128091","50|sygma_______::a68f3fa6e34dcae0fbbb5bd4bb023e8c"],"pids":[{"scheme":"doi","value":"10.1145/3600160.3605037"},{"scheme":"handle","value":"11695/128091"}],"dateOfCollection":null,"lastUpdateTimeStamp":null,"indicators":{"citationImpact":{"citationCount":6.0,"influence":2.6674223E-9,"popularity":5.7536895E-9,"impulse":6.0,"citationClass":"C5","influenceClass":"C5","impulseClass":"C4","popularityClass":"C4"}},"projects":[{"id":"corda_____he::9ce4795c43250f481c709ae85d41b183","code":"101086308","acronym":"DUCA","title":"Data Usage Control for empowering digital sovereignty for All citizens","funder":"European Commission","pids":[{"scheme":"doi","value":"10.3030/101086308"}]}],"organizations":[{"legalName":"University of Molise","acronym":"UNIMOL","id":"openorgs____::1399698736743569904b8fff1e02556a","pids":[{"scheme":"OrgReg","value":"IT0015"},{"scheme":"ROR","value":"https://ror.org/04z08z627"},{"scheme":"FundRef","value":"501100012305"},{"scheme":"wikidata","value":"Q1093340"},{"scheme":"PIC","value":"999850005"},{"scheme":"OrgRef","value":"4933616"},{"scheme":"ISNI","value":"0000000122055422"},{"scheme":"fundref","value":"501100012305"},{"scheme":"Wikidata","value":"Q1093340"},{"scheme":"mag_id","value":"129627893"},{"scheme":"GRID","value":"grid.10373.36"}],"countries":[{"code":"IT","label":"Italy"}],"websiteurl":"http://www.unimol.it/"},{"legalName":"National Research Council","acronym":"CNR","id":"openorgs____::d41cf6bd4ab1b1362a44397e0b95c975","pids":[{"scheme":"ROR","value":"https://ror.org/04zaypm56"},{"scheme":"Wikidata","value":"Q902464"},{"scheme":"fundref","value":"501100004462"},{"scheme":"PIC","value":"999979500"},{"scheme":"OrgReg","value":"IT1002"},{"scheme":"RRID","value":"RRID:nlx_33409"},{"scheme":"ISNI","value":"0000000119404177"},{"scheme":"wikidata","value":"Q902464"},{"scheme":"FundRef","value":"501100004462"},{"scheme":"PIC","value":"997940560"},{"scheme":"OrgRef","value":"1819946"},{"scheme":"PIC","value":"952138324"},{"scheme":"GRID","value":"grid.5326.2"},{"scheme":"RRID","value":"RRID:SCR_011322"}],"countries":[{"code":"IT","label":"Italy"}],"websiteurl":"http://cnr.it"}],"communities":[{"code":"eu-conexus","label":"European University for Smart Urban Coastal Sustainability","provenance":null},{"code":"cnr","label":"CNR","provenance":null}],"collectedFrom":[{"key":"openaire____::a8db6f6b2ce4fe72e8b2314a9a93e7d9","value":"Sygma"},{"key":"opendoar____::1bda4c789c38754f639a376716c5859f","value":"Archivio Istituzionale della Ricerca - Università degli Studi del Molise"},{"key":"openaire____::081b82f96300b6a6e3d282bad31cb6e2","value":"Crossref"},{"key":"openaire____::d8b68cc0a53121f6f896883a7d60c1db","value":"DBLP"}],"instances":[{"pids":[{"scheme":"doi","value":"10.1145/3600160.3605037"}],"license":"https://www.acm.org/publications/policies/copyright_policy#Background","accessRight":{"code":"c_14cb","label":"CLOSED","scheme":"http://vocabularies.coar-repositories.org/documentation/access_rights/","openAccessRoute":null},"type":"Article","urls":["https://doi.org/10.1145/3600160.3605037"],"publicationDate":"2023-08-29","refereed":"peerReviewed","hostedBy":{"key":"openaire____::55045bd2a65019fd8e6741a755395c8c","value":"Unknown Repository"},"collectedFrom":{"key":"openaire____::081b82f96300b6a6e3d282bad31cb6e2","value":"Crossref"}},{"alternateIdentifiers":[{"scheme":"doi","value":"10.1145/3600160.3605037"}],"type":"Conference object","urls":["https://doi.org/10.1145/3600160.3605037","https://dblp.org/rec/conf/IEEEares/MercaldoCSM23.html"],"refereed":"nonPeerReviewed","hostedBy":{"key":"openaire____::d8b68cc0a53121f6f896883a7d60c1db","value":"DBLP"},"collectedFrom":{"key":"openaire____::d8b68cc0a53121f6f896883a7d60c1db","value":"DBLP"}},{"pids":[{"scheme":"handle","value":"11695/128091"}],"alternateIdentifiers":[{"scheme":"urn","value":"2-s2.0-85169687495"},{"scheme":"doi","value":"10.1145/3600160.3605037"}],"accessRight":{"code":"c_14cb","label":"CLOSED","scheme":"http://vocabularies.coar-repositories.org/documentation/access_rights/","openAccessRoute":null},"type":"Conference object","urls":["https://doi.org/10.1145/3600160.3605037","https://hdl.handle.net/11695/128091"],"publicationDate":"2023-01-01","refereed":"nonPeerReviewed","hostedBy":{"key":"opendoar____::1bda4c789c38754f639a376716c5859f","value":"Archivio Istituzionale della Ricerca - Università degli Studi del Molise"},"collectedFrom":{"key":"opendoar____::1bda4c789c38754f639a376716c5859f","value":"Archivio Istituzionale della Ricerca - Università degli Studi del Molise"}},{"alternateIdentifiers":[{"scheme":"doi","value":"10.1145/3600160.3605037"}],"license":"https://www.acm.org/publications/policies/copyright_policy#Background","type":"Conference object","urls":["http://dx.doi.org/10.1145/3600160.3605037"],"refereed":"nonPeerReviewed","hostedBy":{"key":"openaire____::55045bd2a65019fd8e6741a755395c8c","value":"Unknown Repository"},"collectedFrom":{"key":"openaire____::a8db6f6b2ce4fe72e8b2314a9a93e7d9","value":"Sygma"}}],"links":[{"header":{"relationType":"resultProject","relationClass":"isProducedBy","relatedIdentifier":"corda_____he::9ce4795c43250f481c709ae85d41b183","relatedRecordType":"project","relationProvenance":"sysimport:crosswalk","trust":"0.9"},"collectedfrom":[{"dsId":"openaire____::3f264f93cf3b0cfc4ede188a6300455c","dsName":"CORDA - COmmon Research DAta Warehouse - Horizon Europe"}],"projectTitle":"Data Usage Control for empowering digital sovereignty for All citizens","code":"101086308","funding":{"funder":{"id":"ec__________::EC","shortname":"EC","name":"European Commission","jurisdiction":{"code":"EU","label":"European Union"},"pid":null},"level0":{"id":"ec__________::EC::HE","description":"Horizon Europe Framework Programme","name":"HE"},"level1":{"id":"ec__________::EC::HE::HORIZON-TMA-MSCA-SE","description":"HORIZON TMA MSCA Staff Exchanges","name":"HORIZON-TMA-MSCA-SE"},"level2":{"id":null,"description":null,"name":null}},"startDate":"2023-01-01","endDate":"2026-12-31"}],"otherTitles":null,"inDiamondJournal":false,"green":false,"isGreen":false,"isInDiamondJournal":false}