N-opcode analysis for android malware classification and categorization

Abstract

Malware detection is a growing problem particularly on the Android mobile platform due to its increasing popularity and accessibility to numerous third party app markets. This has also been made worse by the increasingly sophisticated detection avoidance techniques employed by emerging malware families. This calls for more effective techniques for detection and classification of Android malware. Hence, in this paper we present an n-opcode analysis based approach that utilizes machine learning to classify and categorize Android malware. This approach enables automated feature discovery that eliminates the need for applying expert or domain knowledge to define the needed features. Our experiments on 2520 samples that were performed using up to 10-gram opcode features showed that an f-measure of 98% is achievable using this approach.

Machine learning-based dynamic analysis of Android apps with improved code coverage

“…In the static analysis approach, the code is usually reverse engineered and examined for presence of any malicious code. [24][25][26][27][28][29][30][31][32][33][34] are examples of detection solutions based on static analysis. Dynamic analysis on the other hand, involves executing apps in a controlled environment such as a sandbox, virtual machine, or a physical device in order to trace its behavior.…”

Longitudinal performance analysis of machine learning based Android malware detectors

“…It was evaluated on 1386 benign apps and 1296 malapps achieving a detection accuracy of up to 98.4%. Some papers such as [10], [11], [12], [29] and [30], employ static analysisbased opcode features with machine learning for Android malware detection. Other papers utilize tools such as Droidbox [13] or Dynalog [14] to extract dynamic features [15] for training machine learning based classifiers.…”

Malware Detection Using 1-Dimensional Convolutional Neural Networks

“…The authors from [19] aimed at utilizing the benefits of the n-gram based approaches while trying to minimize the dimensionality of the feature input space by evaluating the relative importance of the various extracted n-grams. [11] used a similar strategy and extract n-grams of operation codes from binaries, which are then used for detection.…”

“…In this paper, we compare our deep learning based detector's functionality with a benchmark detector that we implemented, which is closely related, in terms of the principles used, to the works like [25], [11] and [27]. In the work of [24], the authors work with multiple extracted features form binaries, some of which revolve around the notion of capturing structure-related attributes of binaries by collecting n-gram based statistics.…”