DroidTTP: Mapping Android Applications with TTP for Cyber Threat Intelligence

• URL: http://arxiv.org/abs/2503.15866v1
• Date: Thu, 20 Mar 2025 05:38:24 GMT
• Title: DroidTTP: Mapping Android Applications with TTP for Cyber Threat Intelligence
• Abstract summary: DroidTTP is a framework mapping Android malware behaviors to Tactics, Techniques, and Procedures (TTPs)<n>Our dataset explicitly links MITRE TTPs to Android applications.<n>We developed an automated solution leveraging the Problem Transformation Approach (PTA) and Large Language Models (LLMs)
• Score: 13.958337678497163
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: The widespread adoption of Android devices for sensitive operations like banking and communication has made them prime targets for cyber threats, particularly Advanced Persistent Threats (APT) and sophisticated malware attacks. Traditional malware detection methods rely on binary classification, failing to provide insights into adversarial Tactics, Techniques, and Procedures (TTPs). Understanding malware behavior is crucial for enhancing cybersecurity defenses. To address this gap, we introduce DroidTTP, a framework mapping Android malware behaviors to TTPs based on the MITRE ATT&CK framework. Our curated dataset explicitly links MITRE TTPs to Android applications. We developed an automated solution leveraging the Problem Transformation Approach (PTA) and Large Language Models (LLMs) to map applications to both Tactics and Techniques. Additionally, we employed Retrieval-Augmented Generation (RAG) with prompt engineering and LLM fine-tuning for TTP predictions. Our structured pipeline includes dataset creation, hyperparameter tuning, data augmentation, feature selection, model development, and SHAP-based model interpretability. Among LLMs, Llama achieved the highest performance in Tactic classification with a Jaccard Similarity of 0.9583 and Hamming Loss of 0.0182, and in Technique classification with a Jaccard Similarity of 0.9348 and Hamming Loss of 0.0127. However, the Label Powerset XGBoost model outperformed LLMs, achieving a Jaccard Similarity of 0.9893 for Tactic classification and 0.9753 for Technique classification, with a Hamming Loss of 0.0054 and 0.0050, respectively. While XGBoost showed superior performance, the narrow margin highlights the potential of LLM-based approaches in TTP classification.

Related papers

• GenTI: Benchmarking LLMs for Autonomous IDPS Rule Generation for Unseen Attacks [1.7816843507516946]
  Generative Thread Intelligence (GenTI) is a benchmark for automatic generation of IDPS rules targeting unseen attacks.<n>GTI aggregates over 150k detection and prevention rules from Snort, Suricata, Emerging Threats, as well as 50k YARA, each annotated with protocol behavior, payload signatures, contextual relationships, mappings to Cyber Threat Intelligence (CTI)<n>Our GenTI instantiation achieves a composite rule-quality score of 89.4%, with 94.8% CTI coverage, improving unseen attacks detection from 45% to 87.4% and reducing the false-positive rate from 8.5%
  arXiv  Detail & Related papers  (2026-06-04T08:19:52Z)
• Test-Time Training Undermines Safety Guardrails [53.00299679873018]
  Test-Time Training (TTT) is an emerging paradigm that enables models to adapt their parameters during inference.<n>We identify three threat models for TTT and demonstrate how attackers can leverage them to bypass safety filters.
  arXiv  Detail & Related papers  (2026-05-21T19:27:06Z)
• T-MAP: Red-Teaming LLM Agents with Trajectory-aware Evolutionary Search [49.99459363244884]
  We propose a trajectory-aware evolutionary search method, T-MAP, which leverages execution trajectories to guide the discovery of adversarial prompts.<n>Our approach enables the automatic generation of attacks that not only bypass safety guardrails but also reliably realize harmful objectives through actual tool interactions.
  arXiv  Detail & Related papers  (2026-03-21T12:33:34Z)
• A Lightweight Defense Mechanism against Next Generation of Phishing Emails using Distilled Attention-Augmented BiLSTM [34.0814379994364]
  The MobileBERT teacher receives fine-tuning before its transformation into a BiLSTM model with multi-head attention.<n>The system demonstrates excellent performance in terms of accuracy and latency while maintaining a compact size.<n>The paper examines system performance under high traffic conditions and security measures for privacy protection and implementation methods for operational deployment.
  arXiv  Detail & Related papers  (2026-02-24T20:06:45Z)
• Empirical Evaluation of SMOTE in Android Malware Detection with Machine Learning: Challenges and Performance in CICMalDroid 2020 [0.0]
  This work tests Machine Learning algorithms in detecting malicious code from dynamic execution characteristics.<n>In 75% of the tested configurations, the application of SMOTE led to performance degradation or only marginal improvements.<n>Tree-based algorithms, such as XGBoost and Random Forest, consistently outperformed the others, achieving weighted recall above 94%.
  arXiv  Detail & Related papers  (2026-02-09T14:47:47Z)
• Comparison of Multiple Classifiers for Android Malware Detection with Emphasis on Feature Insights Using CICMalDroid 2020 Dataset [0.0]
  Signature scanners lagged behind fast release cycles on public app stores.<n>We used CICMalDroid PCA2020, which contained 17,341 apps across Benign, Banking, SMS malware, and Riskware.<n> gradient boosting on the original features performed best.
  arXiv  Detail & Related papers  (2026-01-20T04:50:58Z)
• PRISM: Distributed Inference for Foundation Models at Edge [73.54372283220444]
  PRISM is a communication-efficient and compute-aware strategy for distributed Transformer inference on edge devices.<n>We evaluate PRISM on ViT, BERT, and GPT-2 across diverse datasets.
  arXiv  Detail & Related papers  (2025-07-16T11:25:03Z)
• TrajTok: Technical Report for 2025 Waymo Open Sim Agents Challenge [58.952909068296314]
  We introduce TrajTok, a trajectory tokenizer for discrete next-token-prediction based behavior generation models.<n>We adopt the tokenizer and loss for the SMART model and reach a superior performance with realism score of 0.7852 on the Open Sim Agents Challenge 2025.
  arXiv  Detail & Related papers  (2025-06-23T08:32:05Z)
• T2V-OptJail: Discrete Prompt Optimization for Text-to-Video Jailbreak Attacks [67.91652526657599]
  We formalize the T2V jailbreak attack as a discrete optimization problem and propose a joint objective-based optimization framework, called T2V-OptJail.<n>We conduct large-scale experiments on several T2V models, covering both open-source models and real commercial closed-source models.<n>The proposed method improves 11.4% and 10.0% over the existing state-of-the-art method in terms of attack success rate.
  arXiv  Detail & Related papers  (2025-05-10T16:04:52Z)
• Semantic-Aware Contrastive Fine-Tuning: Boosting Multimodal Malware Classification with Discriminative Embeddings [2.1874189959020427]
  Large Language Models (LLMs) offer potential for generating malware descriptions to aid family classification. We propose a contrastive fine-tuning (CFT) method that refines LLM embeddings via targeted selection of hard negative samples. Our approach combines high-similarity negatives to enhance discriminative power and mid-tier negatives to increase embedding diversity.
  arXiv  Detail & Related papers  (2025-04-25T02:41:45Z)
• R-TPT: Improving Adversarial Robustness of Vision-Language Models through Test-Time Prompt Tuning [97.49610356913874]
  We propose a robust test-time prompt tuning (R-TPT) for vision-language models (VLMs) R-TPT mitigates the impact of adversarial attacks during the inference stage. We introduce a plug-and-play reliability-based weighted ensembling strategy to strengthen the defense.
  arXiv  Detail & Related papers  (2025-04-15T13:49:31Z)
• Efficient Adversarial Detection Frameworks for Vehicle-to-Microgrid Services in Edge Computing [6.75253870287079]
  Malicious actors exploit vulnerabilities in Machine Learning algorithms to disrupt power generation and distribution. We propose a novel strategy that optimize detection models for Vehicle-to-Microgrid (V2M) edge environments. Our approach integrates model design and compression into a unified process and results in a highly compact detection model.
  arXiv  Detail & Related papers  (2025-03-25T03:26:49Z)
• How Robust Are Router-LLMs? Analysis of the Fragility of LLM Routing Capabilities [62.474732677086855]
  Large language model (LLM) routing has emerged as a crucial strategy for balancing computational costs with performance. We propose the DSC benchmark: Diverse, Simple, and Categorized, an evaluation framework that categorizes router performance across a broad spectrum of query types.
  arXiv  Detail & Related papers  (2025-03-20T19:52:30Z)
• APT-LLM: Embedding-Based Anomaly Detection of Cyber Advanced Persistent Threats Using Large Language Models [4.956245032674048]
  APTs pose a major cybersecurity challenge due to their stealth and ability to mimic normal system behavior.<n>This paper introduces APT-LLM, a novel embedding-based anomaly detection framework.<n>It integrates large language models (LLMs) with autoencoder architectures to detect APTs.
  arXiv  Detail & Related papers  (2025-02-13T15:01:18Z)
• Examining the Rat in the Tunnel: Interpretable Multi-Label Classification of Tor-based Malware [3.62129446831783]
  Malicious traffic on Tor can induce congestion and reduce Tor's performance. Recent research demonstrates the potential for accurately classifying captured Tor traffic as malicious or benign.
  arXiv  Detail & Related papers  (2024-09-25T05:38:09Z)
• Model Surgery: Modulating LLM's Behavior Via Simple Parameter Editing [63.20133320524577]
  We show that editing a small subset of parameters can effectively modulate specific behaviors of large language models (LLMs)<n>Our approach achieves reductions of up to 90.0% in toxicity on the RealToxicityPrompts dataset and 49.2% on ToxiGen.
  arXiv  Detail & Related papers  (2024-07-11T17:52:03Z)
• Tactics, Techniques, and Procedures (TTPs) in Interpreted Malware: A Zero-Shot Generation with Large Language Models [18.024835965133104]
  Interpreted OSS malware plays a vital role in software supply chain attacks. We propose GENTTP, a zero-shot approach to extracting a TTP of an interpreted malware package. We show that GENTTP can generate TTPs with high accuracy and efficiency.
  arXiv  Detail & Related papers  (2024-07-11T14:18:41Z)
• FaultGuard: A Generative Approach to Resilient Fault Prediction in Smart Electrical Grids [53.2306792009435]
  FaultGuard is the first framework for fault type and zone classification resilient to adversarial attacks. We propose a low-complexity fault prediction model and an online adversarial training technique to enhance robustness. Our model outclasses the state-of-the-art for resilient fault prediction benchmarking, with an accuracy of up to 0.958.
  arXiv  Detail & Related papers  (2024-03-26T08:51:23Z)
• Here Comes The AI Worm: Unleashing Zero-click Worms that Target GenAI-Powered Applications [6.904930679944526]
  Morris-II is a computer worm-like chain reaction that we call GenAI-powered applications.<n>We evaluate the performance of the worm in creating a chain of confidential user data extraction within a GenAI ecosystem of GenAI-powered email assistants.<n>We introduce the Virtual Donkey, a guardrail intended to detect and prevent the propagation of Morris-II with minimal latency, high accuracy, and a low false-positive rate.
  arXiv  Detail & Related papers  (2024-03-05T09:37:13Z)
• A New Deep Boosted CNN and Ensemble Learning based IoT Malware Detection [0.0]
  Security issues are threatened in various types of networks, especially in the Internet of Things (IoT) environment. We have developed a new malware detection framework, Deep Squeezed-Boosted and Ensemble Learning (DSBEL), comprised of novel Squeezed-Boosted Boundary-Region Split-Transform-Merge (SB-BR-STM) CNN and ensemble learning.
  arXiv  Detail & Related papers  (2022-12-15T18:14:51Z)
• Adversarial Attacks and Defense for Non-Parametric Two-Sample Tests [73.32304304788838]
  This paper systematically uncovers the failure mode of non-parametric TSTs through adversarial attacks. To enable TST-agnostic attacks, we propose an ensemble attack framework that jointly minimizes the different types of test criteria. To robustify TSTs, we propose a max-min optimization that iteratively generates adversarial pairs to train the deep kernels.
  arXiv  Detail & Related papers  (2022-02-07T11:18:04Z)
• Sparse and Imperceptible Adversarial Attack via a Homotopy Algorithm [93.80082636284922]
  Sparse adversarial attacks can fool deep networks (DNNs) by only perturbing a few pixels. Recent efforts combine it with another l_infty perturbation on magnitudes. We propose a homotopy algorithm to tackle the sparsity and neural perturbation framework.
  arXiv  Detail & Related papers  (2021-06-10T20:11:36Z)
• Revisiting LSTM Networks for Semi-Supervised Text Classification via Mixed Objective Function [106.69643619725652]
  We develop a training strategy that allows even a simple BiLSTM model, when trained with cross-entropy loss, to achieve competitive results. We report state-of-the-art results for text classification task on several benchmark datasets.
  arXiv  Detail & Related papers  (2020-09-08T21:55:22Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.