Name2Pkg：基于名称-包名对应关系建模的轻量级单类安卓恶意软件筛查
Name2Pkg: Lightweight One-Class Android Malware Screening via Name-Package Correspondence Modeling
浏览论文内容
中文总结 AI 辅助
Name2Pkg利用应用名与包名的弱对应关系，通过字符级序列模型进行单类异常检测，实现轻量级恶意软件筛查，ROC-AUC达0.982，为大规模系统提供高效预过滤信号。
中文摘要 AI 辅助
基于深度学习的恶意软件检测已被广泛采用于安全关键服务中。大多数检测方法依赖于从APK文件或运行时行为中提取的内部特征。然而，提取这些特征的计算成本高昂，限制了它们在大型、早期筛查中的应用。恶意应用可能在其面向用户的应用程序名称与包名之间表现出较弱的对应关系，这提供了一种低成本的筛查信号。我们提出了Name2Pkg，一种轻量级的单类分类方法，仅利用应用程序名称和包名。我们将恶意软件筛查表述为一个序列异常检测问题。一个字符级序列到序列模型估计在给定应用程序名称条件下包名的条件似然。长度归一化的负对数似然作为异常分数。我们仅使用良性数据训练模型并校准阈值。使用包含67,129个真实世界应用的数据集，Name2Pkg在留出测试数据上实现了接收者操作特征曲线下面积（ROC-AUC）为0.982，在假阳性率为0.044时恶意软件召回率为0.885。其检查点大小为3.57 MiB，每样本的CPU推理延迟为28.20毫秒。Name2Pkg为大规模安全系统提供了高效且有效的预过滤信号。
英文摘要
Deep learning-based malware detection has been widely adopted in security-critical services. Most detection methods rely on internal features extracted from APK files or runtime behavior. However, extracting these features is computationally expensive. This limits their use in large-scale, early-stage screening. Malicious apps may exhibit weak correspondence between their user-facing app names and package names, providing a low-cost screening signal. We present Name2Pkg, a lightweight one-class classification method. It leverages only the app name and the package name. We formulate malware screening as a sequence anomaly detection problem. A character-level sequence-to-sequence model estimates the conditional likelihood of a package name given the app name. The length-normalized negative log-likelihood serves as the anomaly score. We train the model and calibrate the threshold using only benign data. Using a dataset of 67,129 real-world applications, Name2Pkg achieves an area under the receiver operating characteristic curve (ROC-AUC) of 0.982 and malware recall of 0.885 at an achieved false-positive rate of 0.044 on held-out test data. It has a 3.57 MiB checkpoint and a CPU inference latency of 28.20 ms per sample. Name2Pkg provides an efficient and effective pre-filtering signal for large-scale security systems.
发表机构
- School of Cybersecurity Korea University（韩国大学网络安全学院）
- IT Planning Department Hana Bank（韩亚银行IT规划部）
机构由 AI 辅助整理，请以论文原文为准。
