Constructing Features for Detecting Android Malicious Applications: Issues, Taxonomy and Directions

Abstract

The number of applications (apps) available for smart devices or Android based IoT (Internet of Things) has surged dramatically over the past few years. Meanwhile, the volume of ill-designed or malicious apps (malapps) has been growing explosively. To ensure the quality and security of the apps in the markets, many approaches have been proposed in recent years to discriminate malapps from benign ones. Machine learning is usually utilized in classification process. Accurately characterizing apps' behaviors, or so-called features, directly affects the detection results with machine learning algorithms. Android apps evolve very fast. The size of current apps has become increasingly large and the behaviors of apps have become increasingly complicated. The extracting effective and representative features from apps is thus an ongoing challenge. Although many types of features have been extracted in existing work, to the best of our knowledge, no work has systematically surveyed the features constructed for detecting Android malapps. In this paper, we are motivated to provide a clear and comprehensive survey of the state-of-the-art work that detects malapps by characterizing behaviors of apps with various types of features. Through the designed criteria, we collect a total of 1947 papers in which 236 papers are used for the survey with four dimensions: the features extracted, the feature selection methods employed if any, the detection methods used, and the scale of evaluation performed. Based on our in-depth survey, we highlight the issues of exploring effective features from apps, provide the taxonomy of these features and indicate the future directions.

ContractWard: Automated Vulnerability Detection Models for Ethereum Smart Contracts

“…It does not need to repeatedly execute the same opcodes, and thus can be time-saving. In our previous work, we detected anomalies or malware with static [38]- [42] or dynamic analysis [43]- [45] or with network traffic [46]- [49]. While our previous work detected potential malicious behaviors in systems or networks, in this work, we mainly focused on the detection of vulnerabilities in the smart contracts running on blockchain.…”

MADFU: An Improved Malicious Application Detection Method Based on Features Uncertainty

“…Millions of Android apps are installed by mobile devices. Meanwhile, a large number of Android malicious apps are constantly appearing [ 1 ]. AppBrain [ 2 ] shows that, by the end of February 2019, there were more than 2.5 million apps available on Google Play.…”

“…Static detection consumes less time and resources. However, static detection technology is difficult to detect obfuscated or repackaged malicious Apps [ 1 ]. In contrast, dynamic analysis attempts to identify malicious behavior after deploying and executing applications on an emulator or real device [ 9 ].…”

“…In order to protect users’ information security, the Android app uses a permission mechanism to access the user’s sensitive information [ 1 ]. When an app is installed, it will provide users with a list of permissions for the app.…”

Ransomware Detection System for Android Applications

“…Static analysis is an effective mechanism in any Android malware or ransomware detection system [28] and API calls feature is a key static metric that is utilized to identify malicious behaviors [29][30][31]. Therefore, this paper provides a deep analysis of API calls to investigate the extent of their influence on the accuracy of the detection process.…”