Malware detection by applying knowledge discovery processes to application metadata on the Android Market (Google Play)

Abstract

Recent smartphone platforms based on new operating systems, such as iOS, Android, or Windows Phone, have been a huge success in recent years and open up many new opportunities. Unfortunately, 2011 also showed us that the new technologies and the privacy‐related data on smartphones are also increasingly interesting for attackers. Especially, the Android platform has been the favorite target for malware, mainly because of the openness of the platform, the ability to install applications from other sources than the Android Market, and the significant gains in market share. Although the processes of detecting and analyzing malware are well known from the PC world, where the arms race between attackers and defenders has continued for the past 15 years, they cannot be directly applied to smartphone platforms because of differences in the hardware and software architectures. In this paper, we first give an overview of the current malware situation on smartphone platforms with a special focus on Android and explain relevant malware detection and analysis methods. It turns out that most of the current malware relies on the installation by the user, who represents the last line of defense in malware detection. With these conclusions, we then present a new malware detection method that focuses on the information that the user is able to see prior to the installation of an application—the metadata within the platform's software market. Depending on the platform, this includes the application's description, its permissions, the ratings, or information about the developer. To analyze these data, we use sophisticated knowledge discovery processes and lean statistical methods. By presenting a wide range of examples based on real application metadata extracted from the Android Market, we show the possibilities of the new method. With the possibilities, we argue that it should be an essential part of a complete malware analysis/detection chain that includes other well‐known methods such as network traffic analysis, or static, or dynamic code inspection. Copyright © 2013 John Wiley & Sons, Ltd.

A Survey of App Store Analysis for Software Engineering

“…Teufl et al [218] mined 130,211 apps from Google Play and performed clustering on both app descriptions and requested permissions, as part of their activation patterns malware detection approach. They later extended this work [217] to propose a first-step malware detection method using links between description terms and security permissions to identify suspicious outliers. In 2013 Mokarizadeh et al [166] performed clustering on 21,065 apps, mined from Google Play, after applying topic modelling on app descriptions.…”

MaMaDroid

“…have also been used to distinguish between malicious and benign apps. Droidmat [70] uses API call tracing and manifest files to learn features for malware detection, Teufl et al [62] apply knowledge discovery processes and lean statistical methods on app metadata extracted from the app market, while [25] rely on embedded call graphs. DroidMiner [73] studies the program logic of sensitive Android/Java framework API functions and resources, and detects malicious behavior patterns.…”

Trust It or Not? An Empirical Study of Rating Mechanism and Its Impact on Smartphone Malware Propagation

“…As smartphones have become a major target for attackers, various research studies have focused on the detection of malware from market [8,10]. There are also some studies discussing recommender and rating systems [3,7].…”