DroidLight

Abstract

Smartphone malware attacks are increasing alongside the growth of smartphone applications in the market. Researchers have proposed techniques to detect malware attacks using various approaches, which broadly include signature and anomaly-based intrusion detection systems (IDSs). Anomaly-based IDSs usually require training machine learning models with datasets collected from running both benign and malware applications. This may result in low detection accuracy when detecting zero-day malwares, i.e. those not previously seen or recorded. In this paper, we propose DroidLight, a lightweight IDS which can detect zero-day malware eciently and eectively. We designed an algorithm for DroidLight that is based on one class classication and probability distribution analysis. For each smartphone application, the classication model learns its normal CPU utilisation and network trac pattern. The model ags an intrusion alert if there is any signicant deviation from the normal pattern. By deploying three self-developed malwares we performed realistic evaluation of DroidLight, i.e. the evaluation was performed on a real device while a real user was interacting with it. Evaluation results demonstrate that DroidLight can detect smartphone malwares with accuracy ranging from 93.3% to 100% while imposing only 1.5% total overhead on device resources. CCS CONCEPTS• Security and privacy → Malware and its mitigation; Intrusion detection systems; Denial-of-service attacks; • Humancentered computing → Smartphones; • Computing methodologies → Classication and regression trees.

Comprehensive Analysis to Detect Mobile Malware Using Multiple Techniques

“…Depending on how serious the anomaly is and how the system is set up, automated actions like app quarantine, user notification etc. may be started [15]. [14] observed that detecting mobile malware has become essential as popular platforms such as Android and iOS face growing vulnerabilities, resulting in a billion-dollar industry that exploits victims for revenue.…”

“…They suggests avenues for further studies to enhance detection accuracy, scalability, evasion resilience against attacks in malware detectors discussing important issues that should be considered when investigating emerging technology trends while addressing present limitations facing this field. Sakil Barbhuiya et al ( 2020) [15] focuses on the Smartphone Intrusion Detection Systems (IDSs) are categorized into categories: efficient IDSs and one-magnificence type for phone IDSs. Efficient IDSs encompass signature-based totally and anomaly-based totally systems.…”

Tight Arms Race: Overview of Current Malware Threats and Trends in Their Detection

“…Even though ML algorithms have not always been successful in detecting zero-day attacks, the recent studies seem to challenge this. In [151], the authors presented a solution based on a refined one class classification (OCC) models which were selected based on the application running in the foreground. Using the scenarios of information theft, currency-mining bot, and DDoS attack on a smartphone, the authors showed that their method was able to detect zero-day malware effectively, without significant overhead.…”