Machine learning aided Android malware classification

Abstract

Malware have been used as a means for conducting cyber attacks for decades. Wide adoption of smartphones, which store lots of private and confidential information, made them an important target for malware developers. Android as the dominant mobile operating system has always been an interesting platform for malware developers and lots of Android malware species are infecting vulnerable users every day which make manual malware investigation an impossible mission. Leveraging machine learning techniques for malware forensics would assist cyber forensic investigators in their fight against malicious programs. In this paper, we present two machine learning aided approaches for static analysis of the mobile applications: one based on permissions , while the other based on source code analysis that utilizes a bag of words representation model. Our source code based classification achieved F-score of 95.1%, while the approach that used permission names only performed with F-measure of 89%. Our approach provides a method for automated static code analysis and malware detection with high accuracy and reduces smartphone malware analysis time.

DroidFusion: A Novel Multilevel Classifier Fusion Approach for Android Malware Detection

“…This method is also being applied to the detection of Android malware. For example Milosevic et al [50] investigated classifer fusion approach with static analysis based on Android permissions and source code-based analysis. They used SVM, C.45, Decision Trees, Random Tree, Random Forests, JRip and linear regression classifiers.…”

Know Abnormal, Find Evil: Frequent Pattern Mining for Ransomware Threat Hunting and Intelligence

“…In spite of its simplicity and primitive utilization of cryptographic techniques [29], ransomware programs are becoming a major tool in cyber criminals' toolset [30]. For any cyber threat, prevention is ideal but detection is a must and ransomware is not an exception [7], [31].…”

“…The volume, scope and cost of cybercrime all remain on an upward trend [4]. Malicious programs have always been an important tool in cyber criminals portfolios [5], [6] and almost everyday we are detecting new variants of malware programs [7]. Development and wide adoption of e-currencies such as Bitcoin led to many changes in cybercriminal activities [8], [9] including development of a new type of malware called ransomware [10].…”

A Blockchain-based Framework for Detecting Malicious Mobile Applications in App Stores

“…Most mobile malware detection systems are focused on local file analysis [11]. Malware analysis involves two key techniques: static analysis and dynamic analysis [12].…”