Assessing Modality Selection Heuristics to Improve Multimodal Machine Learning for Malware Detection

With the growing usage of Android devices, security threats are also growing. While there are some existing malware detection methods, cybercriminals continue to develop ways to evade these security mechanisms. Thus, malware detection systems also need to evolve to meet this challenge. This work is a step towards achieving that goal. Malware detection methods need as much information as possible about the potential malware, and a multimodal approach can help in this regard by combining differing aspects of an Android application. Using multimodal deep learning, it is possible to automatically learn a hierarchical representation for each modality and to give more weights to the more reliable modalities. Multiple modalities can improve classification by providing complementary information, however, the use of all available modalities does not necessarily maximize algorithm performance. Thus, multimodal machine learning could benefit from a mechanism to guide the selection of modalities to include in a multimodal model. This work uses a malware detection problem to compare multiple heuristics for this selection process and the assumptions behind them. Our experiments show that selection modalities with low predictive correlation work better than the other examined heuristics.