Interestingly this is also true for the memory dump approach, relinquishing the need for continuous app monitoring. Results show that when using VAE, SpotCheck attains a level of effectiveness comparable to what has been previously achieved for network anomaly detection.

We compare Kernel Principal Component Analysis (KPCA) and Variational Autoencoders (VAE) on app execution representations based on the well-known system call traces, as well as a novel approach based on memory dumps. It samples app executions and submits suspicious apps to more thorough processing by malware sandboxes. In this work we propose SpotCheck, an anomaly detector intended to run on Android devices. An additional protection layer capable of novelty detection is therefore needed. While security mechanisms are deployed at various levels, these are frequently put under strain by previously unseen malware. In recent years the PC has been replaced by mobile devices for many security sensitive operations, both from a privacy and a financial standpoint.

Anomaly 2 apk data