Reference : On the Lack of Consensus in Anti-Virus Decisions: Metrics and Insights on Building Gr...

	Document type :	Scientific congresses, symposiums and conference proceedings : Paper published in a book
	Discipline(s) :	Engineering, computing & technology : Computer science
	Focus Areas :	Security, Reliability and Trust
	To cite this reference:	http://hdl.handle.net/10993/27845

Title :	On the Lack of Consensus in Anti-Virus Decisions: Metrics and Insights on Building Ground Truths of Android Malware
Language :	English
Author, co-author :	Hurier, Médéric [University of Luxembourg > Interdisciplinary Centre for Security, Reliability and Trust (SNT) > >]
	Allix, Kevin [University of Luxembourg > Interdisciplinary Centre for Security, Reliability and Trust (SNT) > Computer Science and Communications Research Unit (CSC) >]
	Bissyande, Tegawendé François D Assise [University of Luxembourg > Interdisciplinary Centre for Security, Reliability and Trust (SNT) > >]
	Klein, Jacques [University of Luxembourg > Interdisciplinary Centre for Security, Reliability and Trust (SNT) > Computer Science and Communications Research Unit (CSC) >]
	Le Traon, Yves [University of Luxembourg > Faculty of Science, Technology and Communication (FSTC) > Computer Science and Communications Research Unit (CSC) >]
Publication date :	2016
Main document title :	Detection of Intrusions and Malware, and Vulnerability Assessment - 13th International Conference
Publisher :	Springer
Collection and collection volume :	Lecture Notes in Computer Science; 9721
Pages :	142--162
Peer reviewed :	Yes
Audience :	International
ISBN :	978-3-319-40666-4
Event name :	13th International Conference on Detection of Intrusions and Malware, and Vulnerability Assessment
Event date :	July 7-8, 2016
Event place (city) :	San Sebastian
Event country :	Spain
Keywords :	[en] Android ; malware ; ground-truth
Abstract :	[en] There is generally a lack of consensus in Antivirus (AV) engines' decisions on a given sample. This challenges the building of authoritative ground-truth datasets. Instead, researchers and practitioners may rely on unvalidated approaches to build their ground truth, e.g., by considering decisions from a selected set of Antivirus vendors or by setting up a threshold number of positive detections before classifying a sample. Both approaches are biased as they implicitly either decide on ranking AV products, or they consider that all AV decisions have equal weights. In this paper, we extensively investigate the lack of agreement among AV engines. To that end, we propose a set of metrics that quantitatively describe the different dimensions of this lack of consensus. We show how our metrics can bring important insights by using the detection results of 66 AV products on 2 million Android apps as a case study. Our analysis focuses not only on AV binary decision but also on the notoriously hard problem of labels that AVs associate with suspicious files, and allows to highlight biases hidden in the collection of a malware ground truth---a foundation stone of any machine learning-based malware detection approach.
Research centres :	University of Luxembourg: Interdisciplinary Centre for Security, Reliability and Trust - SNT
Target :	Researchers ; Professionals ; Students
Permalink :	http://hdl.handle.net/10993/27845
DOI :	10.1007/978-3-319-40667-1_8
FnR project :	FnR ; FNR5921289 > Jacques Klein > AndroMap > Static Analysis For Android Security: Building the Map of Android Inter-Application Communication > 01/04/2014 > 31/03/2017 > 2013

	File(s) associated to this reference
	Fulltext file(s): File Commentary Version Size Access Open access PAPER.pdf Author preprint 528.73 kB View/Open

All documents in ORBi^lu are protected by a user license.

 

University of Luxembourg Library |  Feedback |  Legal notices Site Map