Android Malware Detection Based on Useful API Calls and Machine Learning

Jung, Jaemin; Kim, Hyun‐Jin; Shin, Dongjin; Lee, Myeonggeon; Lee, Hyunjae; Cho, Seong-Je; Suh, Kyoungwon

doi:10.1109/aike.2018.00041

Cited by 45 publications

(25 citation statements)

References 9 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Second, the proposed system relies on the information derived from the source code to recognize malicious applications by retrieving the prominent application programming interface (API) calls requested by the malware. Numerous studies [9][10][11][12][13][14][15][16] have suggested that API calls can indicate malicious behavior and provide a detailed evaluation of the applications under investigation. Third, Term Frequency-Inverse Document Frequency (TF-IDF) was employed as a feature-weighting technique to reduce the importance of commonly requested features and increase the importance of rarely requested features.…”

Section: )mentioning

confidence: 99%

Automated Malware Detection in Mobile App Stores Based on Robust Feature Generation

Alazab

2020

Electronics

View full text Add to dashboard Cite

Many Internet of Things (IoT) services are currently tracked and regulated via mobile devices, making them vulnerable to privacy attacks and exploitation by various malicious applications. Current solutions are unable to keep pace with the rapid growth of malware and are limited by low detection accuracy, long discovery time, complex implementation, and high computational costs associated with the processor speed, power, and memory. Therefore, an automated intelligence technique is necessary for detecting apps containing malware and effectively predicting cyberattacks in mobile marketplaces. In this study, a system for classifying mobile marketplaces applications using real-world datasets is proposed, which analyzes the source code to identify malicious apps. A rich feature set of application programming interface (API) calls is proposed to capture the regularities in apps containing malicious content. Two feature-selection methods—Chi-Square and ANOVA—were examined in conjunction with ten supervised machine-learning algorithms. The detection accuracy of each classifier was evaluated to identify the most reliable classifier for malware detection using various feature sets. Chi-Square was found to have a higher detection accuracy as compared to ANOVA. The proposed system achieved a detection accuracy of 98.1% with a classification time of 1.22 s. Furthermore, the proposed system required a reduced number of API calls (500 instead of 9000) to be incorporated as features.

show abstract

Section: )mentioning

confidence: 99%

Automated Malware Detection in Mobile App Stores Based on Robust Feature Generation

Alazab

2020

Electronics

View full text Add to dashboard Cite

show abstract

“…Since the range of the proportion is [0, 1], but the range of the pixel is [0, 255], the range needs to be mapped, and the process is shown in formula (4).…”

Section: ) File Visualizationmentioning

confidence: 99%

“…To improve efficiency, API calls are mainly adopted as features at present. Jung et al [4] built an API feature set and classified samples by machine learning. Ma et al [5] added API call frequency and API call sequence as characteristics based on API calls.…”

Section: Introductionmentioning

confidence: 99%

Android Malware Familial Classification Based on DEX File Section Features

et al. 2020

View full text Add to dashboard Cite

The rapid proliferation of Android malware is challenging the classification of the Android malware family. The traditional static method for classification is easily affected by the confusion and reinforcement, while the dynamic method is expensive in computation. To solve these problems, this paper proposes an Android malware familial classification method based on Dalvik Executable (DEX) file section features. First, the DEX file is converted into RGB (Red/Green/Blue) image and plain text respectively, and then, the color and texture of image and text are extracted as features. Finally, a feature fusion algorithm based on multiple kernel learning is used for classification. In this experiment, the Android Malware Dataset (AMD) was selected as the sample set. Two different comparative experiments were set up, and the method in this paper was compared with the common visualization method and feature fusion method. The results show that our method has a better classification effect with precision, recall and F1 score reaching 0.96. Besides, the time of feature extraction in this paper is reduced by 2.999 seconds compared with the method of frequent subsequence. In conclusion, the method proposed in this paper is efficient and precise in the classification of the Android malware family. INDEX TERMS Android malware family, DEX file section, multiple kernel learning.

show abstract

“…Their experiments reveal that API calls, system library usage and operation sequences are important features for malware detection. The API calls made by applications are used as features for malware classification in a recent work by Jung et al [18]. The approach presented in the paper does not consider sequence of API calls as a whole.…”

Section: Related Workmentioning

confidence: 99%

Malware Detection on Highly Imbalanced Data through Sequence Modeling

Oak

Yan

et al. 2019

Proceedings of the 12th ACM Workshop on Artificial Intelligence and Security

View full text Add to dashboard Cite

We explore the task of Android malware detection based on dynamic analysis of application activity sequences using deep learning techniques. We show that analyzing a sequence of the activities is informative for detecting malware, but that analyzing longer sequences does not necessarily lead to a more accurate model. In the real-world scenario, the number of malware is low compared to that of harmless applications. Our dataset has more than 180,000 samples, two-thirds of which are malware. This dataset is significantly larger than other datasets used in previous studies. We mimic real-world cases by randomly sampling a small portion of malware samples. Using the state-of-the-art model BERT, we show that it is possible to achieve desired malware detection performance with an extremely unbalanced dataset. We find that our BERT based model achieves an F1 score of 0.919 with just 0.5% of the examples being malware, which significantly outperforms current state-of-the-art approaches. The results validate the effectiveness of our proposed method in dealing with highly imbalanced datasets. CCS CONCEPTS • Security and privacy → Malware and its mitigation.

show abstract

Android Malware Detection Based on Useful API Calls and Machine Learning

Cited by 45 publications

References 9 publications

Automated Malware Detection in Mobile App Stores Based on Robust Feature Generation

Automated Malware Detection in Mobile App Stores Based on Robust Feature Generation

Android Malware Familial Classification Based on DEX File Section Features

Malware Detection on Highly Imbalanced Data through Sequence Modeling

Contact Info

Product

Resources

About