Abstract:Android, the most popular mobile operating system, has attracted millions of users around the world. Meanwhile, the number of new Android malware instances has grown exponentially in recent years. On the one hand, existing Android malware detection systems have shown that distilling the program semantics into a graph representation and detecting malicious programs by conducting graph matching are able to achieve high accuracy on detecting Android malware. However, these traditional graph-based approaches always perform expensive program analysis and suffer from low scalability on malware detection. On the other hand, because of the high scalability of social network analysis, it has been applied to complete large-scale malware detection. However, the social-network-analysis-based method only considers simple semantic information (i.e., centrality) for achieving market-wide mobile malware scanning, which may limit the detection effectiveness when benign apps show some similar behaviors as malware. In this article, we aim to combine the high accuracy of traditional graph-based method with the high scalability of social-network-analysis--based method for Android malware detection. Instead of using traditional heavyweight static analysis, we treat function call graphs of apps as complex social networks and apply social-network--based centrality analysis to unearth the central nodes within call graphs. After obtaining the central nodes, the average intimacies between sensitive API calls and central nodes are computed to represent the semantic features of the graphs. We implement our approach in a tool called IntDroid and evaluate it on a dataset of 3,988 benign samples and 4,265 malicious samples. Experimental results show that IntDroid is capable of detecting Android malware with an F-measure of 97.1% while maintaining a True-positive Rate of 99.1%. Although the scalability is not as fast as a social-network-analysis--based method (i.e., MalScan ), compared to a traditional graph-based method, IntDroid is more than six times faster than MaMaDroid . Moreover, in a corpus of apps collected from GooglePlay market, IntDroid is able to identify 28 zero-day malware that can evade detection of existing tools, one of which has been downloaded and installed by more than ten million users. This app has also been flagged as malware by six anti-virus scanners in VirusTotal, one of which is Symantec Mobile Insight .

DAMBA: Detecting Android Malware by ORGB Analysis

Malton: Towards On-Device Non-Invasive Mobile Malware Analysis for ART.

Dissecting Android Malware: Characterization and Evolution

Droid Analytics: A Signature Based Analytic System to Collect, Extract, Analyze and Associate Android Malware

DaDiDroid: An Obfuscation Resilient Tool for Detecting Android Malware via Weighted Directed Call Graph Modelling

DroidAnalytics: A Signature Based Analytic System to Collect, Extract, Analyze and Associate Android Malware

DATDroid: Dynamic Analysis Technique in Android Malware Detection

DroidMD: an Efficient and Scalable Android Malware Detection Approach at Source Code Level

Reviving Android Malware with DroidRide: and How Not To.

Hybrid Dynamic Analysis for Android Malware Protected by Anti-Analysis Techniques with DOOLDA

IntDroid: Android Malware Detection Based on API Intimacy Analysis

DroidNative: Semantic-Based Detection of Android Native Code Malware

Android malware detection: a survey

DL-Droid: Deep learning based android malware detection using real devices

Droiddetector: Android Malware Characterization and Detection Using Deep Learning

MaMaDroid: Detecting Android Malware by Building Markov Chains of Behavioral Models (Extended Version)

A Family of Droids -- Android Malware Detection via Behavioral Modeling: Static vs Dynamic Analysis

DroidNative: Automating and Optimizing Detection of Android Native Code Malware Variants

DroidExaminer: An Android Malware Hybrid Detection System Based on Ensemble Learning

FgDetector: Fine-Grained Android Malware Detection

Android Malware Detection using Deep Learning on API Method Sequences