Android Malware Familial Classification Based on DEX File Section Features

Abstract

The rapid proliferation of Android malware is challenging the classification of the Android malware family. The traditional static method for classification is easily affected by the confusion and reinforcement, while the dynamic method is expensive in computation. To solve these problems, this paper proposes an Android malware familial classification method based on Dalvik Executable (DEX) file section features. First, the DEX file is converted into RGB (Red/Green/Blue) image and plain text respectively, and then, the color and texture of image and text are extracted as features. Finally, a feature fusion algorithm based on multiple kernel learning is used for classification. In this experiment, the Android Malware Dataset (AMD) was selected as the sample set. Two different comparative experiments were set up, and the method in this paper was compared with the common visualization method and feature fusion method. The results show that our method has a better classification effect with precision, recall and F1 score reaching 0.96. Besides, the time of feature extraction in this paper is reduced by 2.999 seconds compared with the method of frequent subsequence. In conclusion, the method proposed in this paper is efficient and precise in the classification of the Android malware family. INDEX TERMS Android malware family, DEX file section, multiple kernel learning.

Android Malware Family Classification and Analysis: Current Status and Future Directions

“…In addition, other malware use an obfuscation technique or encrypted methods which cannot be read or decrypted unless the app is executed. A set of papers [28][29][30][31][32][33][34][35][36][37][38][39]42,[46][47][48]50,52,53,[55][56][57]59,62,63,[65][66][67] used static analysis. Details on the static features used by the papers were discussed in Section 4, Features.…”

“…Some literature classifies the malware to malware families based on image representation. In [28], the authors convert the DEX file into an image and plain text. Then, they extract the color and the texture feature from the image.…”

“…Other papers such as [31,66] use data-flow graph (DFG) and control-flow graph (CFG) as features. In [28], the authors extract the texture, color, and text features from the DEX file. Zhang et al [30] use features extracted from DEX as n-gram and hash code.…”

Review of Android Malware Detection Based on Deep Learning

“…This method transforms the DEX file into RGB image and plain text, then extracts the Generalized Search Trees(GIST) texture features, color features, and plain text features of the image as to features, and uses the feature fusion algorithm for classification based on multi-core machine learning. 96% classification accuracy is achieved on the Android malware dataset (AMD) with 24553 malicious samples [48].…”

“…The detection results show detailed family categories and other information of malicious applications, not just whether the application is malicious. In [48]- [51], it converts file codes into images, and use a neural network to classify Android malware families. See Table 2 for a detailed analysis and comparison.…”