Abstract:According to the recent report, 12 000 new Android malware samples will be generated every day. Efficient identification of evolving malware is an urgent challenge. Traditional methods based on structured features such as permissions and sensitive application programming interface (API) calls lack high-level behavioral semantics to detect evolving malware. The methods based on call graphs (CG) are good at behavioral semantic analysis but face the problem of huge time and space consumption, which leads to low detection efficiency. In this paper, we propose a novel Android malware detection method based on the method-level correlation relationship of application's abstracted API calls. First, we split each Android application's source code into separate function methods and just keep the abstracted API calls of them to form a set of abstracted API calls transactions. And then, we calculate the confidence of association rules between the abstracted API calls, which forms behavioral semantics to describe an application. Finally, we combine machine learning to identify the different behavioral patterns of malicious and benign apps to build the detection system. The results of our empirical evaluation show our system is competitive in terms of classification accuracy and detection efficiency. At dataset Drebin (benign 5.9K and malware 5.6K) and AMD (benign 20.5K and malware 20.8K), our system has achieved 96% and 98% detection results both in accuracy and F-measure. Compared with the state-of-the-art system in detecting evolving malware called MaMaDroid on the dataset of 6.0K benign and 20.5K malicious samples spanning from 2010 to 2017, our system achieves higher accuracy while improving detection efficiency by 15 times (2.9 s versus 45.7 s per sample).

CTDroid: Leveraging a Corpus of Technical Blogs for Android Malware Analysis

LSTM Android Malicious Behavior Analysis Based on Feature Weighting

Dissecting Android Malware: Characterization and Evolution

Malton: Towards On-Device Non-Invasive Mobile Malware Analysis for ART.

Droidetec: Android Malware Detection and Malicious Code Localization through Deep Learning

Deep learning feature exploration for Android malware detection

An Android Malware Detection Method Using Deep Learning Based on API Calls

Droid Analytics: A Signature Based Analytic System to Collect, Extract, Analyze and Associate Android Malware

An Efficient Android Malware Detection System Based on Method-Level Behavioral Semantic Analysis.

DroidAnalytics: A Signature Based Analytic System to Collect, Extract, Analyze and Associate Android Malware

Droiddetector: Android Malware Characterization and Detection Using Deep Learning

KerTSDroid: Detecting Android Malware at Scale Through Kernel Task Structures.

Cyber Code Intelligence for Android Malware Detection

ImageDroid: Using Deep Learning to Efficiently Detect Android Malware and Automatically Mark Malicious Features

OpCode-Level Function Call Graph Based Android Malware Classification Using Deep Learning

Hybrid Sequence‐based Android Malware Detection Using Natural Language Processing

DATDroid: Dynamic Analysis Technique in Android Malware Detection

Detecting Android Malware Based on Dynamic Feature Sequence and Attention Mechanism

MTDroid: A Moving Target Defense Based Android Malware Detector Against Evasion Attacks

Obfuscation-Resilient Android Malware Analysis Based on Complementary Features

Droid-MCFG: Android Malware Detection System Using Manifest and Control Flow Traces with Multi-Head Temporal Convolutional Network