DroidMat: Android Malware Detection through Manifest and API Calls Tracing

Wu, Dong-Jie; Mao, Ching-Hao; Wei, Te-En; Lee, Hahn-Ming; Wu, Ke

doi:10.1109/asiajcis.2012.18

Cited by 478 publications

(238 citation statements)

References 18 publications

Supporting

Mentioning

222

Contrasting

Unclassified

Order By: Relevance

“…Machine-learning-based detection has already been used for detecting malicious Android programs [10], [6]; nevertheless, as far as we know, none of these approaches was assessed on a wide dataset as ours. In order to find the best suited algorithm, we tested some well-known implementation of machine learning algorithm such as libsvm [11] or C 5.0 6 .…”

Section: Classification Mechanismmentioning

confidence: 99%

Using opcode-sequences to detect malicious Android applications

Jérôme

Allix

State

et al. 2014

2014 IEEE International Conference on Communications (ICC)

View full text Add to dashboard Cite

Abstract-Recently, the Android platform has seen its number of malicious applications increased sharply. Motivated by the easy application submission process and the number of alternative market places for distributing Android applications, rogue authors are developing constantly new malicious programs. While current anti-virus software mainly relies on signature detection, the issue of alternative malware detection has to be addressed. In this paper, we present a feature based detection mechanism relying on opcode-sequences combined with machine learning techniques. We assess our tool on both a reference dataset known as Genome Project as well as on a wider sample of 40,000 applications retrieved from the Google Play Store.

show abstract

Section: Classification Mechanismmentioning

confidence: 99%

Using opcode-sequences to detect malicious Android applications

Jérôme

Allix

State

et al. 2014

2014 IEEE International Conference on Communications (ICC)

View full text Add to dashboard Cite

show abstract

“…Their classifier was tested with k-Fold 5 cross validation on a dataset of 91 malware and 2 081 goodware. Using permissions and API calls as features, Wu et al [25] performed their experiments on a dataset of 1 500 goodware and 238 malware. In 2013, Amos et al [26] leveraged dynamic application profiling in their malware detector.…”

Section: Malware Detection and Assessmentsmentioning

confidence: 99%

Are Your Training Datasets Yet Relevant?

Allix

Bissyandé

Klein

et al. 2015

Lecture Notes in Computer Science

View full text Add to dashboard Cite

In this paper, we consider the relevance of timeline in the construction of datasets, to highlight its impact on the performance of a machine learning-based malware detection scheme. Typically, we show that simply picking a random set of known malware to train a malware detector, as it is done in many assessment scenarios from the literature, yields significantly biased results. In the process of assessing the extent of this impact through various experiments, we were also able to confirm a number of intuitive assumptions about Android malware. For instance, we discuss the existence of Android malware lineages and how they could impact the performance of malware detection in the wild.

show abstract

“…We obtained comparable values of recall but much higher values for precision and F-measure. Using permissions and API calls as features, Wu et al (2012) performed their experiments on a dataset of 1 500 goodware and 238 malware. Many of our classifiers exhibit higher values of both precision and recall than theirs.…”

Section: Related Workmentioning

confidence: 99%

Empirical assessment of machine learning-based malware detectors for Android

et al. 2014

View full text Add to dashboard Cite

To address the issue of malware detection through large sets of applications, researchers have recently started to investigate the capabilities of machine-learning techniques for proposing effective approaches. So far, several promising results were recorded in the literature, many approaches being assessed with what we call in the lab validation scenarios. This paper revisits the purpose of malware detection to discuss whether such in the lab validation scenarios provide reliable indications on the performance of malware detectors in real-world settings, aka in the wild.To this end, we have devised several Machine Learning classifiers that rely on a set of features built from applications' CFGs. We use a sizeable dataset of over 50 000 Android applications collected from sources where state-of-the art approaches have selected their data. We show that, in the lab, our approach outperforms existing machine learning-based approaches. However, this high performance does not translate in high performance in the wild. The performance gap we observed-F-measures dropping from over 0.9 in the lab to below 0.1 in the wild -raises one important question: How do state-of-the-art approaches perform in the wild ?

show abstract

DroidMat: Android Malware Detection through Manifest and API Calls Tracing

Cited by 478 publications

References 18 publications

Using opcode-sequences to detect malicious Android applications

Using opcode-sequences to detect malicious Android applications

Are Your Training Datasets Yet Relevant?

Empirical assessment of machine learning-based malware detectors for Android

Contact Info

Product

Resources

About