EMULATOR vs REAL PHONE

Abstract

The Android operating system has become the most popular operating system for smartphones and tablets leading to a rapid rise in malware. Sophisticated Android malware employ detection avoidance techniques in order to hide their malicious activities from analysis tools. These include a wide range of anti-emulator techniques, where the malware programs attempt to hide their malicious activities by detecting the emulator. For this reason, countermeasures against antiemulation are becoming increasingly important in Android malware detection. Analysis and detection based on real devices can alleviate the problems of anti-emulation as well as improve the effectiveness of dynamic analysis. Hence, in this paper we present an investigation of machine learning based malware detection using dynamic analysis on real devices. A tool is implemented to automatically extract dynamic features from Android phones and through several experiments, a comparative analysis of emulator based vs. device based detection by means of several machine learning algorithms is undertaken. Our study shows that several features could be extracted more effectively from the on-device dynamic analysis compared to emulators. It was also found that approximately 24% more apps were successfully analysed on the phone. Furthermore, all of the studied machine learning based detection performed better when applied to features extracted from the on-device dynamic analysis.

Assessment of Machine Learning Classifiers for Malware Detection

“…Random Forest are an outfit learning strategy for grouping, relapse and different errands that works by building a large number of choice trees at preparing time and yielding the class that is the method of the classes or mean expectation of the individual trees [4] . Irregular choice timberlands right for choice trees' propensity for overfitting to their preparation set.…”

Longitudinal performance analysis of machine learning based Android malware detectors

“…Other papers utilize tools such as Droidbox [13] or Dynalog [14] to extract dynamic features [15] for training machine learning based classifiers. Papers [16]- [21] also present dynamic analysis-based work for Android malware detection, while [22], [23], [31] and [32] use both static and dynamic features.…”

Emulation vs Instrumentation for Android Malware Detection

“…Android malware analysis such as SandDroid [19], CopperDroid [15], TraceDroid [20], and NVISO ApkScan [21]. These dynamic approaches can again be discarded on the assumption that they are running on an emulator or virtualized environment [22].…”

“…Feature extraction was performed on two different environments, emulator and real phone. After each application is executed, the emulator is restored which ensures the removal of all third party apps [22].…”

“…As stated in [23] for malicious apps that have capabilities to implement anti-emulator techniques, it is expected that the execution of API call which could lead to the extraction of features that show malicious behavior of the app would not be logged as the malware will attempt to mask this behavior. Figure 4 shows the working of the Dynalog tool [22].…”