Affiliations: [a] Xinjiang General Station of Exit and Entry Frontier Inspection, Urumqi, China
| [b] School of Software, Xinjiang University, Wulumuqi, China
| [c] School of Computer Science and Engineering, Central South Univerisity, Changsha, China
Correspondence:
[*]
Corresponding author. Shengwei Tian, School of Software, Xinjiang University, Wulumuqi, 830001, China. E-mail: tianshengwei@163.com.
Abstract: With the development of the Internet of Things (IoT), mobile devices are playing an increasingly important role in our daily lives. There are various malware threats present in these mobile devices, which can steal users’ personal information. Some malware exploits Inter-Component Communication (ICC) to execute malicious activities for unauthorized data access and system control, enabling communication between different components within an app and between different apps. In this paper, we propose an Adaptive Transformer-based malware framework (named AdaTrans) that combines sensitive Application Programming Interface (API)- and ICC-related features. The framework first extracts sensitive function call subgraphs (SFCS) to reflect the caller-callee relationships, and then utilizes ICC interactions to reveal hidden communication patterns in malicious activities. Moreover, we propose a novel adaptive Transformer model to detect malicious behaviors. We evaluate our framework on real-world datasets and demonstrate that AdaTrans consistently outperforms other existing state-of-the-art systems.
Keywords: Internet of things, ICC, Malware detection, transformer
