Abstract:Due to the continuous evolution of both the Android framework and malware, conventional malware detection methods that have been trained using outdated apps are inadequate in effectively identifying sophisticated evolved malware. To address this issue, in this paper, we propose a novel Android malware detection method with API semantics extraction (AMDASE), it can effectively identify evolved malware instances. Firstly, AMDASE performs API clustering to obtain cluster centers representing API functions before malware detection. We design API sentence to summarize API features and employ natural language processing (NLP) tools to acquire embeddings of API sentence for clustering. With the help of API sentence, it becomes possible to effectively extract the semantics of API contained in features like method name that accurately represents its intended functionality, which also makes the clustering results more accurate. Secondly, AMDASE extracts call graph from each app and optimizes the call graph by removing nodes corresponding to unknown functions, while ensuring the preservation of connectivity between their predecessor and successor nodes. The optimized call graph can extract more robust API contextual information that accurately represents the behavior of each app. Thirdly, in order to maintain resilience against the evolution of Android malware, AMDASE extracts function call pairs from the optimized call graph and abstracts the APIs in function call pairs into cluster centers obtained in API clustering. Finally, feature vectors are generated using one-hot mapping and machine learning classifiers are used for malware detection. We evaluate AMDASE on a dataset of 42,154 benign and 42,450 malicious apps developed over a seven-year period. The experimental results demonstrate that AMDASE greatly outperforms the existing state-of-the-art methods and has a significantly slower aging speed.

EAMDM: an Evolved Android Malware Detection Method Using API Clustering

A Novel Android Malware Detection Method with API Semantics Extraction

EAODroid: Android Malware Detection Based on Enhanced API Order

An Android Malware Detection Method Using Deep Learning Based on API Calls

An Efficient Android Malware Detection System Based on Method-Level Behavioral Semantic Analysis.

EveDroid: Event-Aware Android Malware Detection Against Model Degrading for IoT Devices.

MDADroid

Deep Android Malware Classification with API-Based Feature Graph.

Enhancing State-of-the-art Classifiers with API Semantics to Detect Evolved Android Malware

A Model for Malware Detection Method Based on API Call Sequence Clustering

Mdadroid: A Novel Malware Detection Method by Constructing Functionality-Api Mapping

Detecting Android Malware Based on Extreme Learning Machine.

An Android Malware Detection Method Using Better API Contextual Information.

Detection, Classification and Characterization of Android Malware Using API Data Dependency.

AiDroid: When Heterogeneous Information Network Marries Deep Neural Network for Real-time Android Malware Detection

A Hybrid Deep Network Framework for Android Malware Detection

Android Malware Detection of Calls Tracing with AndroidManifest and API

A Combination Method for Android Malware Detection Based on Control Flow Graphs and Machine Learning Algorithms.

Effective android malware detection with a hybrid model based on deep autoencoder and convolutional neural network

A Detection Method and System Implementation for Android Malware

A Deep Learning Approach To Android Malware Feature Learning And Detection