Explainable AI for Android Malware Detection: Towards Understanding Why the Models Perform So Well?

Yue Liu1; Chakkrit Tantithamthavorn1; Li Li1; Yepang Liu2

10.1109/ISSRE55969.2022.00026

2022-10-31

The 33rd IEEE International Symposium on Software Reliability Engineering (ISSRE 2022)

1071-9458

978-1-6654-5133-8

The 33rd IEEE International Symposium on Software Reliability Engineering (ISSRE 2022)

169-180

31 Oct.-3 Nov. 2022

Charlotte, NC, USA

Machine learning (ML)-based Android malware detection has been one of the most popular research topics in the mobile security community. An increasing number of research studies have demonstrated that machine learning is an effective and promising approach for malware detection, and some works have even claimed that their proposed models could achieve 99% detection accuracy, leaving little room for further improvement. However, numerous prior studies have suggested that unrealistic experimental designs bring substantial biases, resulting in over-optimistic performance in malware detection. Unlike previous research that examined the detection performance of ML classifiers to locate the causes, this study employs Explainable AI (XAI) approaches to explore what ML-based models learned during the training process, inspecting and interpreting why ML-based malware classifiers perform so well under unrealistic experimental settings. We discover that temporal sample inconsistency in the training dataset brings over-optimistic classification performance (up to 99%F1 score and accuracy). Importantly, our results indicate that ML models classify malware based on temporal differences between malware and benign, rather than the actual malicious behaviors. Our evaluation also confirms the fact that unrealistic experimental designs lead to not only unrealistic detection performance but also poor reliability, posing a significant obstacle to real-world applications. These findings suggest that XAI approaches should be used to help practitioners/researchers better understand how do AI/ML models (i.e., malware detection) work-not just focusing on accuracy improvement.

Android Malware Machine Learning Explainable AI

其他

英语

EI

IEEE

1.Faculty of Information Technology, Monash University, Melbourne, Australia
2.Department of Computer Science and Engineering, Southern University of Science and Technology, Shenzhen, China

Yue Liu,Chakkrit Tantithamthavorn,Li Li,et al. Explainable AI for Android Malware Detection: Towards Understanding Why the Models Perform So Well?[C],2022:169-180.