Abstract:According to the recent report, 12 000 new Android malware samples will be generated every day. Efficient identification of evolving malware is an urgent challenge. Traditional methods based on structured features such as permissions and sensitive application programming interface (API) calls lack high-level behavioral semantics to detect evolving malware. The methods based on call graphs (CG) are good at behavioral semantic analysis but face the problem of huge time and space consumption, which leads to low detection efficiency. In this paper, we propose a novel Android malware detection method based on the method-level correlation relationship of application's abstracted API calls. First, we split each Android application's source code into separate function methods and just keep the abstracted API calls of them to form a set of abstracted API calls transactions. And then, we calculate the confidence of association rules between the abstracted API calls, which forms behavioral semantics to describe an application. Finally, we combine machine learning to identify the different behavioral patterns of malicious and benign apps to build the detection system. The results of our empirical evaluation show our system is competitive in terms of classification accuracy and detection efficiency. At dataset Drebin (benign 5.9K and malware 5.6K) and AMD (benign 20.5K and malware 20.8K), our system has achieved 96% and 98% detection results both in accuracy and F-measure. Compared with the state-of-the-art system in detecting evolving malware called MaMaDroid on the dataset of 6.0K benign and 20.5K malicious samples spanning from 2010 to 2017, our system achieves higher accuracy while improving detection efficiency by 15 times (2.9 s versus 45.7 s per sample).

Implementation of a Malware Detect Tool on Android

Dissecting Android Malware: Characterization and Evolution

A Detection Method and System Implementation for Android Malware

Behavior-Based Malware Detection on Mobile Phone

Research of Malware Detection Approach for Android

A Dynamic and Static Combined Android Malicious Code Detection Model Based on SVM.

Real-Time Detection of Malicious Behavior in Android Apps

Android Malware Detection of Calls Tracing with AndroidManifest and API

Reviving Android Malware with DroidRide: and How Not To.

An Effective Online Scheme for Detecting Android Malware

An Android Malware Detection System Based on Behavior Comparison Analysis.

An Efficient Android Malware Detection System Based on Method-Level Behavioral Semantic Analysis.

Malware Detection Technology Analysis and Applied Research of Android Platform

An APP Sensitive Behaviors Detection Method Based on Android Kernel and Its Implementation

Maldetector-Using Permission Combinations to Evaluate Malicious Features of Android App

An Android Behavior-Based Malware Detection Method Using Machine Learning

Monet: A User-oriented Behavior-based Malware Variants Detection System for Android

Detecting Android Malware Based on Dynamic Feature Sequence and Attention Mechanism

Real-Time Behavior Analysis and Identification for Android Application

Android Malware Detection Based on Sensitive Patterns

Dynamic Detection Technology of Malicious Code for Android System