Deep-Layer Clustering to Identify Permission Usage Patterns of Android App Categories

Abstract

With the increasing usage of smartphones in banks, medical services and m-commerce, and the uploading of applications from unofficial sources, security has become a major concern for smartphone users. Malicious apps can steal passwords, leak details, and generally cause havoc with users' accounts. Current anti-virus programs rely on static signatures that need to be changed periodically and cannot identify zero-day malware. The Android permission system is the central security mechanism that regulates the execution of application tasks. Although recent advances in research have provided various approaches and detection methods for finding malware apps, the available literature lacks a full analysis of this subject. We fill this gap by: 1) Systematically and automatically building a large dataset of malware and benign apps, which we have made available to the community. Our dataset has around 16K apps and 118 features. 2) We offer a novel approach for automatically identifying permission usage patterns, which are groupings of permissions that developers frequently utilise together. The approach combines SOM and K-means clustering algorithms to classify permissions according to app usage categories. The results demonstrate that the proposed methodology is able to detect most of the consistent and coherent permission usage patterns across a wide variety of application categories. To assess our strategy, we add the identified patterns as features to our dataset and then apply an SVM classifier for malware detection. Our results indicate that the identified patterns improve the performance of the classifier.

ZTA: A Novel Zero Trust Framework for Detection and Prevention of Malicious Android Applications

“…Z Namurd et al [52] used SOM+K-means to identify permission usage patterns. The results show that the observed use patterns by SOM+K-means increase the efficacy of the malware detection model across various apps in different categories.…”

A comprehensive review on permissions-based Android malware detection

“…Malware datasets used Rovelli et al [115] Genome, Contagio Arp et al [116] Genome,FakeInstaller, GoldDream 27 , GingerMaster 28 , DroidKungFu 29 Yerima et al [117] McAfee Kang et al [118] VirusShare, Contagio, Malware.lu Zhao et al [119] Drebin Qiao et al [120] Genome Chen et al [121] 360 APKs 30 , MobiSec Lab Website 31 , [217] Demertzis et al [122] Magnum-Research 32 Verma et al [123] Contagio, malware forums , security blogs, Genome Wang et al [124] VirusTotal Tang et al [125] Genome, Drebin Wang et al [126] Drebin, Genome Li et al [127] Drebin Bhattacharya et al [128] Contagio Xie et al [129] Genome, VirusShare, Drebin Xie et al [130] Genome, VirusShare, Drebin, antivirus companies Ren et al [131] Anzhi, AndroTotal, Drebin Tao et al [132] VirusShare, Contagio Namrud et al [133] AndroZoo Alswaina et al [134] -Qiu et al [135] -Zhu et al [136] ViruShare Feng et al [137] No Malware Aonzo et al [138] AndroZoo Urooj et al [139] MalDroid [225], DefenseDroid 33 and a small own generated dataset Wang et al [140] No malware Wang et al [141] FakeInst, Opfake, FakeInstaller, Droid-KungFu, GinMaster, Plankton Zhang et al [142] No malware Kesswani et al [143] No malware Ibrahim et al [144] CICMalDroid 2020 Arshad et al [145] Drebin Yuan et al [146] Genome, Contagio Zhou et al [147] Genome Cilleruelo et al [148] Malware selected on the basis of lifespan criteria from Google Play Store ...…”

Double-Layer K-Means++ Clustering Method for Evaluation of Dispatchable Potential of Massive Regional 5G Base Stations

“…Clustering as an unsupervised machine learning algorithm, is a very important data mining technology [10]. It is widely used in the research fields of pattern recognition, spatial data analysis, image processing and marketing etc [11], [12], [13]. The existing classical clustering algorithms can be divided into five types: partition based, hierarchy based, density based, network-based and model-based.…”