ICACT20220029 Slide.16
[Big slide for presentation]
[YouTube] |
Chrome Text-to-Speach Click!! |
 |
Thank you for your attention
|
|
ICACT20220029 Slide.15
[Big slide for presentation]
[YouTube] |
Chrome Text-to-Speach Click!! |
 |
We present an excerpt from our literature review
|
|
ICACT20220029 Slide.14
[Big slide for presentation]
[YouTube] |
Chrome Text-to-Speach Click!! |
 |
We thank PASET-RSIF for their financial support of our work
|
|
ICACT20220029 Slide.13
[Big slide for presentation]
[YouTube] |
Chrome Text-to-Speach Click!! |
 |
In this paper, we proposed an incremental learning approach (UFILA) for Android malware detection and classification.
We used classifiers and a feature update function.
We evaluated UFILA using four separate feature datasets from the same malware and benign dataset.
Our proposed approach outperforms many automatic malware detection approaches in the literature
In our future work, we plan to improve and optimize the update function.
|
|
ICACT20220029 Slide.12
[Big slide for presentation]
[YouTube] |
Chrome Text-to-Speach Click!! |
 |
This allows us to say that the model built from our UFILA approach achieves very good performance values in terms of classification while updating the features.
With the UFILA approach, classification algorithms outperform the results obtained in classical machine learning
|
|
ICACT20220029 Slide.11
[Big slide for presentation]
[YouTube] |
Chrome Text-to-Speach Click!! |
 |
Figure 4 shows the precision, recall and F1 score metrics obtained by the UFILA approach applied to the dataset D4. The metrics vary for both classes between 98% and 100% for each of the two used algorithms (Extra Trees and Light Gradient Boosting)
|
|
ICACT20220029 Slide.10
[Big slide for presentation]
[YouTube] |
Chrome Text-to-Speach Click!! |
 |
Figure 3 shows the precision, recall and F1 score metrics obtained by the UFILA approach applied to the dataset D4. The metrics vary for both classes between 96% and 100% for each of the two used algorithms(Random Forest and Decision Tree)
|
|
ICACT20220029 Slide.09
[Big slide for presentation]
[YouTube] |
Chrome Text-to-Speach Click!! |
 |
We observed figure 2 for our four algorithms that our model becomes more and more precise when going from Di to Di+1.
Thus the accuracy of the model has increased considerably from the initial dataset to the final dataset. In addition to the increase in accuracy, the model experiences an improvement of the accuracy as we add features.
|
|
ICACT20220029 Slide.08
[Big slide for presentation]
[YouTube] |
Chrome Text-to-Speach Click!! |
 |
For the implementation of our approach, we selected through the literature thirteen classification algorithms that we tested and selected the best for our model. We used the standard confusion matrix metrics to evaluate the performance of our approach.
|
|
ICACT20220029 Slide.07
[Big slide for presentation]
[YouTube] |
Chrome Text-to-Speach Click!! |
 |
For the implementation, we used a dataset consisting of 214 features vectors extracted from 15,036 applications (malware and benign)
For the needs of our experiment, we have to separate the features by category, and we obtain four datasets.
|
|
ICACT20220029 Slide.06
[Big slide for presentation]
[YouTube] |
Chrome Text-to-Speach Click!! |
 |
in the figure 1
Features, The data set , made up of four families of features, is subdivided into four batches noted d1,d2,d3,d4.
Features Update and Backup, The update and save function allows first to recover one by one the copies of the di by concatenating them progressively. The updating of the features and the saving of the copy of the concatenation are carried out.
Data Pre-processing, The pre-processing stage cleans up the data, scales it and subdivides it into two groups: the training set and the test set.
Training and Model , This step allows to train algorithms in order to obtain a classification model
Testing and Predictions result ; In this step we test the performance of the obtained model with other data different from those used for training.
|
|
ICACT20220029 Slide.05
[Big slide for presentation]
[YouTube] |
Chrome Text-to-Speach Click!! |
 |
Our contribution can be resumed by two points :
The proposal of UFILA, which is an efficient and functional system for classifying and identifying Android malware, enabling the features updating.
The evaluation of the effectiveness of UFILA using four classification algorithms
|
|
ICACT20220029 Slide.04
[Big slide for presentation]
[YouTube] |
Chrome Text-to-Speach Click!! |
 |
Li et al. 2020) [5]. have developed an incremental learning method based on the Multiclass SVM called ”IMCSVM”, which gradually improves classification ability by learning new malwares samples. Their incremental learning method is to add new classes to the existing classification model.
(Lopez et al. 2020) [6].proposed a new incremental learning approach that combines a deep functionality encoder with an open dynamic set of SVM, to solve the problem of identification people of interest (IoI) from streaming face data.
(Sanghani and Kotecha 2019) [7]. developed an incremental custom email spam filter, that is an incremental learning framework using SVM which overcomes the limitation of a static decision model to handle drift concept and deeply improves the performance of the classifier.
The proposed approaches either solve a lack of data or a problem of a large amount of data that cannot be provided to the model at once. This is a horizontal update which means an update of the data. The literature explored did not address vertical updates that involve features. But the UFILA approach, our proposal, makes a vertical update.
|
|
ICACT20220029 Slide.03
[Big slide for presentation]
[YouTube] |
Chrome Text-to-Speach Click!! |
 |
The growth in cybercrime has triggered a lot of research to detect or classify Android malwares . According to Zou and al., many developers of malicious applications use obfuscation techniques such as dead code insertion, decryption transposition to hide malware or create variants to escape detection. This makes models obsolete because they cannot detect vulnerabilities that are not taken into account in the training of the model according to Sihag and al
|
|
ICACT20220029 Slide.02
[Big slide for presentation]
[YouTube] |
Chrome Text-to-Speach Click!! |
 |
The outline of the presentation will be as follow
We start with the Context and the Problem.
Then some related works and our Contributions.
After that we present our UFILA approach; followed by the experimental process
next, we present the results
and lastly we conclude.
|
|
ICACT20220029 Slide.01
[Big slide for presentation]
[YouTube] |
Chrome Text-to-Speach Click!! |
 |
Hello everyone,
I am Zakaria Sawadogo, PhD student in Gaston Berger University under the PASET scholarship
I am pleased to present our work about
Android malware classification : Updating Features Through Incremental Learning Approach.
|
