MaMaDroid: Detecting Android Malware by Building Markov Chains of Behavioral Models

Abstract

Abstract-The rise in popularity of the Android platform has resulted in an explosion of malware threats targeting it. As both Android malware and the operating system itself constantly evolve, it is very challenging to design robust malware mitigation techniques that can operate for long periods of time without the need for modifications or costly re-training. In this paper, we present MAMADROID, an Android malware detection system that relies on app behavior. MAMADROID builds a behavioral model, in the form of a Markov chain, from the sequence of abstracted API calls performed by an app, and uses it to extract features and perform classification. By abstracting calls to their packages or families, MAMADROID maintains resilience to API changes and keeps the feature set size manageable. We evaluate its accuracy on a dataset of 8.5K benign and 35.5K malicious apps collected over a period of six years, showing that it not only effectively detects malware (with up to 99% F-measure), but also that the model built by the system keeps its detection capabilities for long periods of time (on average, 86% and 75% F-measure, respectively, one and two years after training). Finally, we compare against DROIDAPIMINER, a state-of-the-art system that relies on the frequency of API calls performed by apps, showing that MAMADROID significantly outperforms it.

Virtual Memory Introspection Framework for Cyber Threat Detection in Virtual Environment

“…The Data Analytics platform consists of centralized database servers for analytics and processing. The research will be focused on identifying the classification and anomaly detection machine learning algorithms that includes open source and commercial platforms, libraries with these platforms [17] [18] to detect malware [19] [20] that primarily focus on the Linux data structure extracted by the VMI Framework.…”

DaDiDroid: An Obfuscation Resilient Tool for Detecting Android Malware via Weighted Directed Call Graph Modelling

“…Classifier In contrast, MaMaDroid [24] shows vulnerability to unbalanced training dataset. In Figure 3b, in the case of using fixed size of malicious apps and a set 1,500 of benign instances in the training phase, we observe that DaDiDroid outperforms MaMaDroid with on average 26% higher accuracy.…”

“…By parsing the API names that correspond to a given Android app in Marvin dataset, we determine this type of obfuscation in our datasets. In essence, leveraging previous works [28,24], we define that an API is obfuscated if either at least 50% of its functions or methods are at most 3 characters or if we cannot tell what its class implements, extends or inherits due to identifier mangling [28].…”

“…DroidAPIMiner [1], for instance, uses the frequency of API calls to classify malware apps. Recently, MaMaDroid [24] leverages the similarity in the code of apps as extracted from the transition probabilities between different API calls to build an efficient Android malware detection system. However, the increased code complexity and the use of obfuscation techniques as a way to protect apps from code theft, reverse engineering and code inspection, pose several challenges to static analysis of malware apps.…”

TriFlow

“…The sheer number of apps available in current markets, along with the ratio at which new apps are submitted, makes impossible to manually analyze all of them. Automated analyses also have their limitations and some techniques might require a substantial amount of time per app [25]. This has motivated the need for a multi-staged analysis pipeline in which apps should be initially triaged to allocate resources intelligently and guarantee that the analysis effort is devoted to those samples that potentially have more security interest.…”