Analysis and Evaluation of SafeDroid v2.0, a Framework for Detecting Malicious Android Applications

Abstract

Android smartphones have become a vital component of the daily routine of millions of people, running a plethora of applications available in the official and alternative marketplaces. Although there are many security mechanisms to scan and filter malicious applications, malware is still able to reach the devices of many end-users. In this paper, we introduce the SafeDroid v2.0 framework, that is a flexible, robust, and versatile open-source solution for statically analysing Android applications, based on machine learning techniques. The main goal of our work, besides the automated production of fully sufficient prediction and classification models in terms of maximum accuracy scores and minimum negative errors, is to offer an out-of-the-box framework that can be employed by the Android security researchers to efficiently experiment to find effective solutions: the SafeDroid v2.0 framework makes it possible to test many different combinations of machine learning classifiers, with a high degree of freedom and flexibility in the choice of features to consider, such as dataset balance and dataset selection. The framework also provides a server, for generating experiment reports, and an Android application, for the verification of the produced models in real-life scenarios. An extensive campaign of experiments is also presented to show how it is possible to efficiently find competitive solutions: the results of our experiments confirm that SafeDroid v2.0 can reach very good performances, even with highly unbalanced dataset inputs and always with a very limited overhead.

Multifeature-Based Behavior of Privilege Escalation Attack Detection Method for Android Applications

“…In [21][22][23][24][25][26], the researchers used machine learning and data mining theory to extract, classify, evaluate, and detect known malicious features, and they provided a direction for further research on permission and API for detecting malicious applications. DroidCat [27] and SafeDroid v2.0 [28] contributed to query strategy, active learning, and simplifying malicious features, while DroidDeep [29] contributed to static feature collection and selection. Androdect [30] constructed the dataset of the component, key function call, and system call based on the feature extraction of the component, function call, and system call; moreover, it used the three-layer hybrid ensemble algorithm for detection.…”

A Critical Analysis on Android Vulnerabilities, Malware, Anti-malware and Anti-malware Bypassing

“…Other attempts such as CHEX [26], SafeDroid [27], AnaDroid [28], ScanDal [29], DroidEnsemble [30], DroidSieve [31], COVA [32] AndroDialysis [33], DroidNative [34], Vulvet [35] and many others; were all limited by the inclination of static analysis and the possibility of malware hiding its malicious act until runtime or using dynamic load, or any other anti-analysis techniques explained in section 5. Researchers in [36] detected the presence of malware using power consumption data.…”

“…SafeDroid [27] is a client-server based antivirus for the android apps which scans the apps and then assigns a label to them based on its signature matching technique which is run by a remote module of the SafeDroid. The client module installed on a device reads the required information from the dex file and sends data to remote service which classify if the app is malicious or not.…”