Abstract:Android is the most widely used mobile operating system (OS). A large number of third-party Android application (app) markets have emerged. The absence of third-party market regulation has prompted research institutions to propose different malware detection techniques. However, due to improvements of malware itself and Android system, it is difficult to design a detection method that can efficiently and effectively detect malicious apps for a long time. Meanwhile, adopting more features will increase the complexity of the model and the computational cost of the system. Permissions play a vital role in the security of the Android apps. Term Frequency—Inverse Document Frequency (TF-IDF) is used to assess the importance of a word for a file set in a corpus. The static analysis method does not need to run the app. It can efficiently and accurately extract the permissions from an app. Based on this cognition and perspective, in this paper, a new static detection method based on TF-IDF and Machine Learning is proposed. The system permissions are extracted in Android application package's (Apk's) manifest file. TF-IDF algorithm is used to calculate the permission value (PV) of each permission and the sensitivity value of apk (SVOA) of each app. The SVOA and the number of the used permissions are learned and tested by machine learning. 6070 benign apps and 9419 malware are used to evaluate the proposed approach. The experiment results show that only use dangerous permissions or the number of used permissions can't accurately distinguish whether an app is malicious or benign. For malware detection, the proposed approach achieve up to 99.5% accuracy and the learning and training time only needs 0.05s. For malware families detection, the accuracy is 99.6%. The results indicate that the method for unknown/new sample's detection accuracy is 92.71%. Compared against other state-of-the-art approaches, the proposed approach is more effective by detecting malware and malware families.

Research on Cryptographic Misuse Detection for Android Applications Based on Dynamic and Static Combination.

CryptoEval: Evaluating the Risk of Cryptographic Misuses in Android Apps with Data-Flow Analysis

CRYLOGGER: Detecting Crypto Misuses Dynamically

To Fix or Not to Fix: A Critical Study of Crypto-misuses in the Wild

Why Crypto-detectors Fail: A Systematic Evaluation of Cryptographic Misuse Detection Techniques

An Improved Android Collusion Attack Detection Method Based on Program Slicing.

A Longitudinal Study of Cryptographic API: a Decade of Android Malware

Security Analysis for Android Applications Using Sensitive Path Identification

Android X-Ray - A system for Malware Detection in Android apps using Dynamic Analysis

Incorporating Android Code Smells into Java Static Code Metrics for Security Risk Prediction of Android Applications

A Dynamic and Static Combined Android Malicious Code Detection Model Based on SVM.

Exploring Automatic Cryptographic API Misuse Detection in the Era of LLMs

Automatic Privacy Leakage Detection for Massive Android Apps Via a Novel Hybrid Approach.

A DETECTION FRAMEWORK OF CODE-HIDING EVASION TECHNIQUE BASED ON ANDROID SYSTEM

Combining Static Permissions and Dynamic Packet Analysis to Improve Android Malware Detection

SAMLDroid: A Static Taint Analysis and Machine Learning Combined High-Accuracy Method for Identifying Android Apps with Location Privacy Leakage Risks

A Privacy Leakage Detection System for Android

DATDroid: Dynamic Analysis Technique in Android Malware Detection

An Android Malicious Application Detection Method with Decision Mechanism in the Operating Environment of Blockchain

An android malware detection approach using multi-feature fusion and TF-IDF algorithm

A detection method for android application security based on TF-IDF and machine learning