Android HIV: A Study of Repackaging Malware for Evading Machine-Learning Detection

Machine learning based solutions have been successfully employed for automatic detection of malware in Android applications. However, machine learning models are known to lack robustness against inputs crafted by an adversary. So far, the adversarial examples can only deceive Android malware detectors that rely on syntactic features, and the perturbations can only be implemented by simply modifying Android manifest. While recent Android malware detectors rely more on semantic features from Dalvik bytecode rather than manifest, existing attacking/defending methods are no longer effective. In this paper, we introduce a new highly-effective attack that generates adversarial examples of Android malware and evades being detected by the current models. To this end, we propose a method of applying optimal perturbations onto Android APK using a substitute model. Based on the transferability concept, the perturbations that successfully deceive the substitute model are likely to deceive the original models as well. We develop an automated tool to generate the adversarial examples without human intervention to apply the attacks. In contrast to existing works, the adversarial examples crafted by our method can also deceive recent machine learning based detectors that rely on semantic features such as control-flow-graph. The perturbations can also be implemented directly onto APK's Dalvik bytecode rather than Android manifest to evade from recent detectors. We evaluated the proposed manipulation methods for adversarial examples by using the same datasets that Drebin and MaMadroid (5879 malware samples) used. Our results show that, the malware detection rates decreased from 96% to 1% in MaMaDroid, and from 97% to 1% in Drebin, with just a small distortion generated by our adversarial examples manipulation method.Comment: 15 pages, 11 figure

Monopole-charged pulsars and relevant issues

The aligned pulsars whose rotation axes and magnetic dipole axes are parallel should be positively charged. The total charge of pulsars is calculated after considering the electromagnetic field in and out the star under a specific condition. The statistical relation between the pulsar's rotation energy loss rate (or the period derivative) and the period may hint that the millisecond radio pulsars with small periods could be low-mass bare strange stars.Comment: 4 pages, 1 figures, and 1 tabl

The Photometric System of Tsinghua-NAOC 80-cm Telescope at NAOC Xinglong Observatory

Tsinghua-NAOC (National Astronomical Observatories of China) Telescope (hereafter, TNT) is an 80-cm Cassegrain reflecting telescope located at Xinglong bservatory of NAOC, with main scientific goals of monitoring various transients in the universe such as supernovae, gamma-ray bursts, novae, variable stars, and active galactic nuclei. We present in this paper a systematic test and analysis of the photometric performance of this telescope. Based on the calibration observations on twelve photometric nights, spanning the period from year 2004 to year 2012, we derived an accurate transformation relationship between the instrumental $ubvri$ magnitudes and standard Johnson $UBV$ and Cousins $RI$ magnitudes. In particular, the color terms and the extinction coefficients of different passbands are well determined. With these data, we also obtained the limiting magnitudes and the photometric precision of TNT. It is worthwhile to point out that the sky background at Xinglong Observatory may become gradually worse over the period from year 2005 to year 2012 (e.g., $\sim$21.4 mag vs. $\sim$20.1 mag in the V band).Comment: 12 pages,9 figures, accepted by RA