Adapting Text Categorization for Manifest based Android Malware Detection

Abstract

Malware is a shorthand of malicious software that are created with the intent of damaging hardware systems, stealing data, and causing a mess to make money, protest something, or even make war between governments. Malware is often spread by downloading some applications for your hardware from some download platforms. It is highly probable to face with a malware while you try to load some applications for your smart phones nowadays. Therefore it is very important that some tools are needed to detect malware before loading them to the hardware systems. There are mainly three different approaches to detect malware: i) static, ii) dynamic, and iii) hybrid. Static approach analyzes the suspicious program without executing it. Dynamic approach, on the other hand, executes the program in a controlled environment and obtains information from operating system during runtime. Hybrid approach, as its name implies, is the combination of these two approaches. Although static approach may seem to have some disadvantages, it is highly preferred because of its lower cost. In this paper, our aim is to develop a static malware detection system by using text categorization techniques. To reach our goal, we apply text mining techniques like feature extraction by using bag-of-words, n-grams, etc. from manifest content of suspicious programs, then apply text classification methods to detect malware. Our experimental results revealed that our approach is capable of detecting malicious applications with an accuracy between 94.0% and 99.3%.

Machine Learning Algorithm for Malware Detection: Taxonomy, Current Challenges, and Future Directions

“…Also, ContagioDump, VirusTotal, and VirusShare were also employed for malware samples. However, in this SLR study, VirusShare [68], [63], [76], [86], [97], [102], [107], [117], [120], [58], [116] is found as the most popular dataset used in their experiments, followed by DREBIN, [67], [72], [80], [87], [88], [108], [109], [62], [64] Malware Genome Project, [114], [115], [64], [74], [112], [118], Google Play Store, [64], [74], [85], [115], [114] and many more type of datasets as shown in TABLE 14 in Appendix A.…”

“…Meta-Heuristic [30] 81.23% -99.91% NF [87], [92], [93] 69.44% -91% Bayesian [32], [49], [66], [67], [88] 80% -> 97% Gaussian [32], [36], [52], [70], [94] 80% -> 91.1% KNN [28], [29], [37], [48], [51], [55], [60], [69], [71], [72], [73], [74], [85], [96], [99], [100] 80.50% -99.2% N-grams [30], [31], [42], [43], [44], [56], [62], [63], [76], [77], [98] 81.23% -100% Meanwhile, each algorithm's average detection accuracy rate has been obtained, and SVM continues to perform well, with a 90.55% accuracy rate. N-grams have the greatest average detection accuracy rate of 97.80%, followed by KNN 92.72%, DT 92.23%, K-Means 89%, Bayesian 89.08%, Gaussian 87.42%, NB 86.45%, NF 83.48%, and Meta-Heuristic with 81.23%.…”

“…, [56], [57], [60], [61], [64], [66], [67], [69], [70], [71], [76], [81], [83], [84], [85], [87], [88], [90], [94], [96], [100], [101], [102], [105], [109], [113], [119], [121], [125] Signaturebased false positive rate and raising the false negative rate overcomes the limitations of heuristic-based approaches.…”

“…Since new malware samples constantly arise [88], the chosen analysis type, as described in the previous sub-section, might influence the performance of the detection accuracy rate. For instance, in some experiments, new malware instant or updated malware attacks can't be detected using static analysis [73].…”

“…In another case, some applications have requested excessive permissions [83] for malware detection. However, because the mobile device's computational resources, processing capability, and memory storage [88] are limited, they have not utilized it. Furthermore, a model learned from attack data collected from one platform cannot be directly applied to analyze attacks targeting other platforms [92].…”