Mobile Malware Classification via System Calls and Permission for GPS Exploitation

Abstract

Abstract-Now-a-days smartphones have been used worldwide for an effective communication which makes our life easier. Unfortunately, currently most of the cyber threats such as identity theft and mobile malwares are targeting smartphone users and based on profit gain. They spread faster among the users especially via the Android smartphones. They exploit the smartphones through many ways such as through Global Positioning System (GPS), SMS, call log, audio or image. Therefore to detect the mobile malwares, this paper presents 32 patterns of permissions and system calls for GPS exploitation by using covering algorithm. The experiment was conducted in a controlled lab environment, by using static and dynamic analyses, with 5560 of Drebin malware datasets were used as the training dataset and 500 mobile apps from Google Play Store for testing. As a result, 21 out of 500 matched with these 32 patterns. These new patterns can be used as guidance for all researchers in the same field in identifying mobile malwares and can be used as the input for a formation of a new mobile malware detection model.

Permission-Based Classification of Android Malware Applications Using Random Forest

“…However, the limitation of this approach is that the applications are not classified to their appropriate family but are detected as malware or not which in some cases is not adequate. A classification method using system calls to GPS data is used in another study on a sample of approximately 5,560 malware applications and 500 random applications in which the researchers found 32 related patterns that were used from the malware applications (Saudi, 2017). In a recent study, Arif et al (2021) used a sample of 10,000 Android applications in order to classify malware applications using static analysis.…”

Detection of Social Media Exploitation via SMS and Camera

“…Features such as API and permission are seen as an opportunity for exploitation [3]. Existing works by [4][5][6][7][8][9][10][11][12] showed the significant of API and permission usage for exploitation and malwares detection. These works used different analysis techniques such as static analysis, dynamic analysis or hybrid analysis.…”

“…These works used different analysis techniques such as static analysis, dynamic analysis or hybrid analysis. As for work from [12], MalDozer is proposed to detect the malwares in different of IoT devices, with API as the input. Even in 2018, works by [13][14][15][16][17] also applied the API and Permission in their work.…”