Currently, Android malware detection is mostly performed on server side
against the increasing number of malware. Powerful computing resource provides
more exhaustive protection for app markets than maintaining detection by a
single user. However, apart from the applications provided by the official
market, apps from unofficial markets and third-party resources are always
causing serious security threats to end-users. Meanwhile, it is a
time-consuming task if the app is downloaded first and then uploaded to the
server side for detection, because the network transmission has a lot of
overhead. In addition, the uploading process also suffers from the security
threats of attackers. Consequently, a last line of defense on mobile devices is
necessary and much-needed. In this paper, we propose an effective Android
malware detection system, MobiTive, leveraging customized deep neural networks
to provide a real-time and responsive detection environment on mobile devices.
MobiTive is a preinstalled solution rather than an app scanning and monitoring
engine using after installation, which is more practical and secure. Original
deep learning models cannot be directly deployed and executed on mobile devices
due to various performance limitations, such as computation power, memory size,
and energy. Therefore, we evaluate and investigate the following key points:(1)
the performance of different feature extraction methods based on source code or
binary code;(2) the performance of different feature type selections for deep
learning on mobile devices;(3) the detection accuracy of different deep neural
networks on mobile devices;(4) the real-time detection performance and accuracy
on different mobile devices;(5) the potential based on the evolution trend of
mobile devices' specifications; and finally we further propose a practical
solution (MobiTive) to detect Android malware on mobile devices.

本论文提出了一种基于深度神经网络的定制化的移动端实时 Android 恶意软件检测系统，MobiTive, 包括不同特征提取方法和不同特征类型选择、不同深度神经网络的检测精度、不同移动设备上的实时检测性能和精度以及基于移动设备规格的演化趋势的检测潜力分析