Risk Assessment Scheme for Mobile Applications Based on Tree Boosting

Abstract

In the forthcoming era of IoT, where everything will be connected, mobile devices will play a key role in providing data sharing and user-centric services between devices. In such a service environment, if a mobile application is vulnerable to security threats and exposed to malicious behavior, malware can spread to hundreds of millions of connected devices. In particular, it is important to isolate and respond quickly to malicious mobile code. This requires the prediction of malicious behavior. Currently, security risk assessment schemes based on the permission use the description of the application or user review, but these schemes mostly offer a subjective evaluation, which inevitably reduces accuracy. In this paper, we thus propose a scheme for assessing security risk of Android mobile applications by analyzing their application programming interfaces (APIs) using machine learning. The key idea of the proposed scheme is to extract the APIs from the execution code of the application with reverse engineering analysis, such that each API can be compared with the malicious API database built from the existing malware dataset. Instead of simply judging the applications as malicious or benign, our scheme shows their risk as a score. To do this quantitative evaluation, we use an ensemble of tree boosting machine learning algorithms. To prove the practicality of the proposed scheme, we experiment with a set of benign and malicious real world samples, and compare our results with existing schemes. Experimental results show better performance and accuracy than conventional schemes based on Naive Bayes and simple ensemble algorithms. Our proposed scheme is expected to significantly contribute in responding rapidly to ever-more-intelligent malware of the future. INDEX TERMS Malware detection, machine learning, XGBoost, risk assessment.

ACAMA: Deep Learning-Based Detection and Classification of Android Malware Using API-Based Features

“…We also evaluated the effectiveness of ACAMA with AVClass. In summary, the evaluation results show that ACAMA outperforms the previous approach proposed by Kim et al [11]. Also, we observed that ACAMA can classify 72.456% of malware that AVClass cannot classify.…”

“…Figure 9 shows the accuracy comparison results between ACAMA and a malicious application detection system proposed by Kim et al [11], closely related with ACAMA, that use APIs as a feature. e verification accuracy is a result of malicious detection by reapplying the list to the training dataset after removing 10% of it to verify the effectiveness of the classifier.…”

“…Approaches. Many approaches were proposed to analyze malicious applications using their APIs [5][6][7][8][9][11][12][13][14][15][16][17]. DroidAPIMiner [6] detected malware with k-Nearest Neighbors (k-NN) [18] by using APIs in malware.…”

“…However, not all of the algorithms used can be considered suitable for API data. Also, the method of bagging ensemble other algorithms is not suitable for classifying malware into specific categories [5,11]. Kim et al's [11] methods, like AVIS, directly scored APIs to create API rankings and quantitatively evaluated applications.…”

“…Also, the method of bagging ensemble other algorithms is not suitable for classifying malware into specific categories [5,11]. Kim et al's [11] methods, like AVIS, directly scored APIs to create API rankings and quantitatively evaluated applications. However, unlike AVIS, the application was quantitatively evaluated using a weighted average value.…”