A detection method for android application security based on TF-IDF and machine learning

Abstract

Android is the most widely used mobile operating system (OS). A large number of thirdparty Android application (app) markets have emerged. The absence of third-party market regulation has prompted research institutions to propose different malware detection techniques. However, due to improvements of malware itself and Android system, it is difficult to design a detection method that can efficiently and effectively detect malicious apps for a long time. Meanwhile, adopting more features will increase the complexity of the model and the computational cost of the system. Permissions play a vital role in the security of the Android apps. Term Frequency-Inverse Document Frequency (TF-IDF) is used to assess the importance of a word for a file set in a corpus. The static analysis method does not need to run the app. It can efficiently and accurately extract the permissions from an app. Based on this cognition and perspective, in this paper, a new static detection method based on TF-IDF and Machine Learning is proposed. The system permissions are extracted in Android application package's (Apk's) manifest file. TF-IDF algorithm is used to calculate the permission value (PV) of each permission and the sensitivity value of apk (SVOA) of each app. The SVOA and the number of the used permissions are learned and tested by machine learning. 6070 benign apps and 9419 malware are used to evaluate the proposed approach. The experiment results show that only use dangerous permissions or the number of used permissions can't accurately distinguish whether an app is malicious or benign. For malware detection, the proposed approach achieve up to 99.5% accuracy and the learning and training time only needs 0.05s. For malware families detection, the accuracy is 99.6%. The results indicate that the method for unknown/new sample's detection accuracy is 92.71%. Compared against other stateof-the-art approaches, the proposed approach is more effective by detecting malware and malware families.

Malware Detection: A Framework for Reverse Engineered Android Applications Through Machine Learning Algorithms

“…What's more noteworthy is that defining the usage of API calls in a single part of the Android platform allows for the creation of the most representative function space or the resources where malicious and benign can be distinguished more easily [54], [55]. If the amount of the classification target is greater than the probability estimates, the classification target of the testing data is then calculated as that label [56]. The objects are Blue or Red; the dividing lines identify the border, so an object on the right side is called blue, meaning benign, a general scenario and likewise.…”

A Natural Language Processing Approach for Instruction Set Architecture Identification

“…The N-gram TF-IDF feature model has been used in cyber security applications such as software vulnerability assessments [47], [48] and cyber threat detection [49], [50], [51], [52]. The authors of [47] used TF-IDF features extracted from bug reports to develop a tool for identifying software bugs.…”

Twitter Sentiment Analysis Using Different Machine Learning and Feature Extraction Techniques

“…The term frequency (TF) in documents refers to the number of times a word appears in the text. The inverse document frequency (IDF) is an indicator of a word's overall value [15]. • (word2vec): Word2vec is a neural network that processes data using two layers.…”