# Droidetec: Android Malware Detection and Malicious Code Localization through Deep Learning

**Authors:** Zhuo Ma, Haoran Ge, Zhuzhu Wang, Yang Liu, Ximeng Liu  
**arXiv:** [2002.03594](https://arxiv.org/abs/2002.03594)  
**Date:** 2020-02-10  
**Summary page:** https://www.summarizepaper.com/en/paper/2002.03594v1/

## Key points

- Droidetec is a deep learning-based method for Android malware detection and malicious code localization
- It models an application program as a natural language sequence
- Utilizes a novel feature extraction method to derive behavior sequences from Android applications
- Employs bi-directional Long Short Term Memory (LSTM) network for malware detection
- Each unit in the extracted behavior sequence is represented as a vector, enabling automatic analysis of semantics and identification of malicious code
- Achieved an accuracy rate of 97.22% with an F1-score of 98.21%
- Had a hit rate of 91% in accurately identifying malicious code segments
- Offers an innovative solution to the long-standing challenge of manual search for potential malicious code in Android applications

## Summary

In the field of building a secure and credible system, detecting Android malware is a crucial step. Manual searching for potential malicious code has posed a challenge for program analysts for a long time. To address this issue, the authors present Droidetec - a deep learning-based method for Android malware detection and malicious code localization. Droidetec models an application program as a natural language sequence and utilizes a novel feature extraction method to derive behavior sequences from Android applications. The bi-directional Long Short Term Memory (LSTM) network is then employed for malware detection. Each unit in the extracted behavior sequence is represented as a vector which enables Droidetec to automatically analyze the semantics of sequence segments and identify malicious code. The effectiveness of Droidetec was demonstrated through experiments involving 9616 malicious and 11982 benign programs. The results show that Droidetec achieved an impressive accuracy rate of 97.22% with an F1-score of 98.21%. It also had a hit rate of 91% in accurately identifying malicious code segments. Overall, the proposed approach presents promising results in Android malware detection and offers an innovative solution to the long-standing challenge of manual search for potential malicious code.