Abstract:According to the recent report, 12 000 new Android malware samples will be generated every day. Efficient identification of evolving malware is an urgent challenge. Traditional methods based on structured features such as permissions and sensitive application programming interface (API) calls lack high-level behavioral semantics to detect evolving malware. The methods based on call graphs (CG) are good at behavioral semantic analysis but face the problem of huge time and space consumption, which leads to low detection efficiency. In this paper, we propose a novel Android malware detection method based on the method-level correlation relationship of application's abstracted API calls. First, we split each Android application's source code into separate function methods and just keep the abstracted API calls of them to form a set of abstracted API calls transactions. And then, we calculate the confidence of association rules between the abstracted API calls, which forms behavioral semantics to describe an application. Finally, we combine machine learning to identify the different behavioral patterns of malicious and benign apps to build the detection system. The results of our empirical evaluation show our system is competitive in terms of classification accuracy and detection efficiency. At dataset Drebin (benign 5.9K and malware 5.6K) and AMD (benign 20.5K and malware 20.8K), our system has achieved 96% and 98% detection results both in accuracy and F-measure. Compared with the state-of-the-art system in detecting evolving malware called MaMaDroid on the dataset of 6.0K benign and 20.5K malicious samples spanning from 2010 to 2017, our system achieves higher accuracy while improving detection efficiency by 15 times (2.9 s versus 45.7 s per sample).

A Malicious Behavior Analysis Method Based on Program Semantic

LSTM Android Malicious Behavior Analysis Based on Feature Weighting

A FEATURE SELECTION AND MODELLING METHOD FOR MALICIOUS CODE

Detecting Malicious JavaScript Code Based on Semantic Analysis.

Component Similarity Based Methods for Automatic Analysis of Malicious Executables

Method for Detecting the Obfuscated Malicious Code Based on Behavior Connection

A method for hidden malcode anomaly detection using dynamic control-flow analysis

A malicious software evaluation system based on behavior association

An Efficient Android Malware Detection System Based on Method-Level Behavioral Semantic Analysis.

Design and Implementation of Malware Automated Analysis Tool Based on Behavior Analysis

AnaDroid: Malware Analysis of Android with User-supplied Predicates

K-Means Clustering Analysis Based On Adaptive Weights For Malicious Code Detection

Implicit-Flow-Sensitive Method for Detection of Trojan-Spy Programs

Malicious Code Detection Based on Software Fingerprint

The Similarity Analysis of Malicious Software

A Static Method for Detection of Information Theft Malware

Reverse Technique Of Malicious Obfuscated Binary Code Based On Control Flow Graph

Malicious Code Detection Using Opcode Running Tree Representation

Successive Memory Image Analysis Method for Malicious Codes

Control Flow-Based Opcode Behavior Analysis for Malware Detection

Dynamic Analysis of Malicious Code