Ensemble Method for Mobile Malware Detection using N-Gram Sequences of System Calls

Abstract

Mobile device has become an essential tool among the community across the globe and has turned into a necessity in daily life. An extensive usage of mobile devices for everyday life tasks such as online banking, online shopping and exchanging e-mails has enable mobile devices to become data storage for users. The data stored in these mobile devices can contain sensitive and critical information to the users. Hence, making mobile devices as the prime target for cybercriminal. To date, Android based mobile devices is one of the mobile devices that are dominating the phone market. Moreover, the ease of use and open-source feature has made Android based mobile devices popular. However, the widely used Android mobile devices has encourage malware author to write malicious application. In a short duration of time mobile malware has rapidly evolve and have the capability to bypass signature detection approach which requires a constant signature update to detect mobile malware. To overcome this drawback an anomaly detection approach can be used to mitigate this issue. Yet, using a single classifier in an anomaly detection approach will not improve the classification detection performance. Based on this reason, this research formulates an ensemble classification method of different n-gram system call sequence features to improve the accuracy of mobile malware detection. This research proposes n-number of classifier models for each different n-gram sequence call feature. The probability output of each classifier is then combined to produce a better classification performance which is better compared to a single classifier.

Run-Time Failure Detection Via Non-Intrusive Event Analysis in a Large-Scale Cloud Computing Platform

“…We adopted an ngram-based solution and a probabilistic model approach because sequence analysis approaches are widely used in practice. As matter of fact, there are several research studies adopting n-grams (or similar algorithms) and probabilistic models to perform run-time detection of anomalies up to now [87,88,89,90,91,92]. Moreover, we did not include more complex approaches, such as neural networks-based approaches, since they require massive data for training [81,93,94].…”