Through the years, the market for mobile devices has been rapidly increasing, and as a result of this trend, mobile malware has become sophisticated. Researchers are focused on the design and development of malware detection systems to strengthen the security and integrity of sensitive and private information. In this context, deep learning is exploited, also in cybersecurity, showing the ability to build models aimed at detecting whether an application is Trusted or malicious. Recently, with the introduction of quantum computing, we have been witnessing the introduction of quantum algorithms in Machine Learning. In this paper, we provide a comparison between five state-of-the-art Convolutional Neural Network models (i.e., AlexNet, MobileNet, EfficientNet, VGG16, and VGG19), one network developed by the authors (called Standard-CNN), and two quantum models (i.e., a hybrid quantum model and a fully quantum neural network) to classify malware. In addition to the classification, we provide explainability behind the model predictions, by adopting the Gradient-weighted Class Activation Mapping to highlight the areas of the image obtained from the application symptomatic of a certain prediction, to the convolutional and to the quantum models obtaining the best performances in Android malware detection. Real-world experiments were performed on a dataset composed of 8446 Android malicious and legitimate applications, obtaining interesting results.

With the growth of the mobile market, malicious applications represent a risk to the security of the users. To mitigate this aspect, researchers proposed different techniques to spot and identify unsafe software placed on the market. On the other hand, malicious writers started to develop ever more sophisticated strategies to hide malicious payloads, in particular through the adoption of obfuscation techniques. The latter consists of hiding the behavior and purpose of malware from antimalware. In this paper, we propose and design a method aimed to detect obfuscated malware. The proposed method builds images directly from system call traces obtained from legitimate, malicious, and obfuscated Android applications. In addition, to show that dynamic analysis and deep learning can build resilient models we propose two experiments using a convolutional neural network. In the first experiment, we train and test the model using a dataset composed of malware, while in the second we train the model using the malware dataset but the model is evaluated using a dataset composed of obfuscated malware. Finally, we analyze the malware and obfuscated detection models from the point of view of explainability using two different class activation mapping algorithms, to understand whether the model predictions can be considered resilient.

Mobile malware is growing in number and its complexity is constantly increasing. Malware authors are continuously looking new ways to elude anti-malware controls. Anti-malware are not able to detect zero-day malware, because to detect malicious behaviour they need to know its signature, but to have this information the malware must already be widespread. Furthermore, anti-malware are able to scan one application at a time: for this reason a type of malware characterized by the colluding attack, where the malicious action is split in two (or more) applications, can not be recognised. To demonstrate the ineffectiveness of current anti-malware mechanisms in recognizing colluding attacks, in this paper we propose SteælErgon, a framework aimed to inject a malicious payload in two or more different Android applications. Clearly the malicious payload will be executed once all the applications composing the collusive attacks are installed into the infected device. In detail, SteælErgon is able to inject a collusive malicious payload attacking the external storage, allowing the attacker to catch sensitive and private information stored into the infected device. We perform an experimental analysis by submitting the generated colluding application to different 79 anti-malware, by showing that current detection mechanism are not able to detect this kind of threat. To boost research in focusing the attention in colluding attacks we freely release SteælErgon, is available for research purposes at the following url: https://github.com/vigimella/StealErgon.