  The evolution of mobile malware poses a serious threat to smartphone
security. Today, sophisticated attackers can adapt by maximally sabotaging
machine-learning classifiers via polluting training data, rendering most recent
machine learning-based malware detection tools (such as Drebin, DroidAPIMiner,
and MaMaDroid) ineffective. In this paper, we explore the feasibility of
constructing crafted malware samples; examine how machine-learning classifiers
can be misled under three different threat models; then conclude that injecting
carefully crafted data into training data can significantly reduce detection
accuracy. To tackle the problem, we propose KuafuDet, a two-phase learning
enhancing approach that learns mobile malware by adversarial detection.
KuafuDet includes an offline training phase that selects and extracts features
from the training set, and an online detection phase that utilizes the
classifier trained by the first phase. To further address the adversarial
environment, these two phases are intertwined through a self-adaptive learning
scheme, wherein an automated camouflage detector is introduced to filter the
suspicious false negatives and feed them back into the training phase. We
finally show that KuafuDet can significantly reduce false negatives and boost
the detection accuracy by at least 15%. Experiments on more than 250,000 mobile
applications demonstrate that KuafuDet is scalable and can be highly effective
as a standalone system.
