Android Malware Familial Classification and Representative Sample Selection via Frequent Subgraph Analysis

Fan, Ming; Liu, Jun; Wang, Liu; Chen, Kai; Tian, Zhenzhou; Zheng, Qinghua; Liu, Ting

doi:10.1109/tifs.2018.2806891

Cited by 202 publications

(120 citation statements)

References 44 publications

Supporting

Mentioning

116

Contrasting

Unclassified

Order By: Relevance

“…In this section, we compare algorithms based on Accuracy, FPR and, AUC metrics with both PDME [17] and FalDroid [19] algorithms which we present them in Tables 5-7. To be precise, in Table 5 about 0.02% above algorithm.…”

Section: Comparing Methods Based On Accuracy Fpr and Aucmentioning

confidence: 99%

“…The WANN and KMNN algorithms also achieve FPR value about 0.004 for both methods; their AUC values are 98.90% and 98.84%, and their accuracy values are 99.31% and 99.28%, respectively. Focusing on the state-of-the art method like PDME algorithm [17], the highest accuracy is 99.21%, which is obtained for 90% of the API features with the FPR value of 0.005 and the AUC 98.96%, while the FalDroid algorithm [19] has the best accuracy by considering 60% of the API features, which is about 90.89% with AUC value 96.17% and with FPR of 0.099, and this method has the worst results (in all metrics presented in Table 5) than the proposed methods. By considering the results of the API features, the accuracy of FNN, ANN, WANN, KMNN, and PDME [17] methods are more than 99% with 80% of the features, and the FalDroid method [19] has no accuracy of more than 90.89%.…”

Section: Comparing Methods Based On Accuracy Fpr and Aucmentioning

confidence: 99%

“…In this section, we compare algorithms based on false positive rate (FPR) and true positive rate (TPR) metrics with both PDME [17] and FalDroid [19] algorithms which we present them in Figs. 6-8.…”

Section: Comparing Methods Based On Rocmentioning

confidence: 99%

“…As we described earlier, ML has been widely used in the classification of various types of Android OS like API, permission, intent and Android malware detection. For example, the paper [19] applies API system call and shapes the API graph, the reference [20] utilizes a score function to the extracted permission feature set, and finally, the paper [21] adopts weighted mutual information to select prominent features. All of these research papers used the KNN algorithm to detect malware; however, due to the lack of binary representation of data, they need several calculations to extract malware vectors from benign samples.…”

Section: Motivation and Open Issuesmentioning

confidence: 99%

“…• f1-Score: The harmonic mean of precision and recall defines as F1-score which we describe it in equation (19): 19) • False Positive Rate (FPR): The FPR is computed as the ratio between the number of negative events incorrectly classified as positive (false positives) and the total number of actual negative events. This metric is described as equation (20): 20) • Area Under Curve (AUC): This metric is a method for determining the best model for predicting the class of samples using all thresholds.…”

Section: Test Metricsmentioning

confidence: 99%

See 4 more Smart Citations

Similarity-based Android malware detection using Hamming distance of static binary features

Taheri

Ghahramani

Javidan

et al. 2020

Future Generation Computer Systems

156

View full text Add to dashboard Cite

In this paper, we develop four malware detection methods using Hamming distance to find similarity between samples which are first nearest neighbors (FNN), all nearest neighbors (ANN), weighted all nearest neighbors (WANN), and k-medoid based nearest neighbors (KMNN). In our proposed methods, we can trigger the alarm if we detect an Android app is malicious. Hence, our solutions help us to avoid the spread of detected malware on a broader scale. We provide a detailed description of the proposed detection methods and related algorithms. We include an extensive analysis to asses the suitability of our proposed similaritybased detection methods. In this way, we perform our experiments on three datasets, including benign and malware Android apps like Drebin, Contagio, and Genome. Thus, to corroborate the actual effectiveness of our classifier, we carry out performance comparisons with some state-of-the-art classification and malware detection algorithms, namely Mixed and Separated solutions, the program dissimilarity measure based on entropy (PDME) and the FalDroid algorithms. We test our experiments in a different type of features: API, intent, and permission features on these three datasets. The results confirm that accuracy rates of proposed algorithms are more than 90% and in some cases (i.e., considering API features) are more than 99%, and are comparable with existing state-of-the-art solutions. * Corresponding author Email addresses: r.taheri@sutech.ac.ir (Rahim Taheri), m.ghahramani@sutech.ac.ir (Meysam Ghahramani), r.javidan@sutech.ac.ir (Reza Javidan), mohammad.shojafar@ryerson.ca (Mohammad Shojafar),

show abstract

Section: Comparing Methods Based On Accuracy Fpr and Aucmentioning

confidence: 99%

Section: Comparing Methods Based On Accuracy Fpr and Aucmentioning

confidence: 99%

Section: Comparing Methods Based On Rocmentioning

confidence: 99%

Section: Motivation and Open Issuesmentioning

confidence: 99%

Section: Test Metricsmentioning

confidence: 99%

See 3 more Smart Citations

Similarity-based Android malware detection using Hamming distance of static binary features

Taheri

Ghahramani

Javidan

et al. 2020

Future Generation Computer Systems

156

View full text Add to dashboard Cite

show abstract

Detection of malware applications from centrality measures of syscall graph

Surendran¹,

Thomas²

2022

Concurrency and Computation

View full text Add to dashboard Cite

These days it is found that malware authors tend to create new variants of existing Android malware by using various kinds of obfuscation techniques. These kinds of obfuscated malware applications can bypass all the current antimalware products which rely on static analysis techniques to detect the malicious behavior. Hence, it is essential to develop innovative dynamic analysis mechanisms for Android malware detection. It is known that, the malicious behavior of statically obfuscated malware applications can get reflected in the system call (syscall) trace generated by them. Most of the existing syscall based mechanisms depend only on the features derived from the syscall counts for malware detection. These syscall count related features are inadequate to capture many other useful characteristics related to the syscalls in a sequence.In order to overcome this limitation, we modeled the syscall trace of an application as an ordered graph which enabled to infer various kinds of features in the form of centrality measures related to that syscall trace of the application. Then, these centrality measures are fed to an ML model to predict the malicious behavior. From the implementation results, we found that our mechanism can detect malware apps with an accuracy of 0.99.

show abstract

Federated malware detection based on many‐objective optimization in cross‐architectural IoT

Zhang,

Cui

2023

Concurrency and Computation

View full text Add to dashboard Cite

SummaryWith the rising adoption of the Internet of Things (IoT) across a variety of industries, malware is increasingly targeting the large number of IoT devices that lack adequate protection. Malware hunting is challenging in the IoT due to the variety of instruction set architectures of devices, as shown by the differences in the relevant characteristics of malware on different platforms. There are also serious concerns about resource utilization and privacy leaks in the development of conventional detection models. This study suggests a novel federated malware detection framework based on many‐objective optimization (FMDMO) for the IoT to overcome the problems. First, the framework provides a cross‐platform compatible basis with the federated mechanism as the backbone, while avoiding raw data sharing to improve privacy protection. Second, an intelligent optimization‐based client selection method is designed for four objectives: learning performance, architectural selection deviation, time consumption, and training stability, which leads malware detection to retain a high degree of cross‐architectural generalization while enhancing training efficiency. Based on a large IoT malware dataset we constructed, containing 62,515 malware samples across seven typical architectures, the FMDMO is evaluated comprehensively in three scenarios. The experimental results demonstrate the FMDMO substantially enhances the model's cross‐platform detection performance while preserving effective training and flexibility.

show abstract

Android Malware Familial Classification and Representative Sample Selection via Frequent Subgraph Analysis

Cited by 202 publications

References 44 publications

Similarity-based Android malware detection using Hamming distance of static binary features

Similarity-based Android malware detection using Hamming distance of static binary features

Detection of malware applications from centrality measures of syscall graph

Federated malware detection based on many‐objective optimization in cross‐architectural IoT

Contact Info

Product

Resources

About