Name2Pkg: Lightweight One-Class Android Malware Screening via Name-Package Correspondence Modeling
Name2Pkg flags Android malware from app-name and package-name mismatch, with ROC-AUC 0.982.
Name2Pkg is a one-class Android malware screener that uses only the user-facing app name and the package name, avoiding costly APK or runtime features. A character-level sequence model estimates how likely a package name is given the app name and is trained and thresholded on benign data alone. On 67,129 real-world applications it reached ROC-AUC 0.982 and malware recall 0.885 at a false-positive rate of 0.044. The 3.57 MiB model infers in 28.20 ms per sample on CPU and is proposed as a pre-filter for large-scale screening.
- Uses only app name and package name, not APK internals.
- ROC-AUC 0.982 and malware recall 0.885 at a 4.4% false-positive rate.
- Trained only on benign data from 67,129 real-world applications.
- Checkpoint is 3.57 MiB, with 28.20 ms CPU inference per sample.
From the original article
1 min read at arxiv.orgDeep learning-based malware detection has been widely adopted in security-critical services. Most detection methods rely on internal features extracted from APK files or runtime behavior. However, extracting these features is computationally expensive.
By Changyeop Sung · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.