High accuracy android malware detection using ensemble learning

Yerima, Suleiman Y.; Sezer, Sakir; Muttik, Igor

doi:10.1049/iet-ifs.2014.0099

Cited by 158 publications

(86 citation statements)

References 34 publications

(66 reference statements)

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…Researchers built ensemble malware detectors [1,10,11,14,17,18,20,22,24,25,29,30,35,36,38], based on combining general detectors. Moreover, most of them used off-line analysis [1,10,14,25,29,30,35,36]. A few used dynamic analysis [11,20,24] and some used both static and dynamic analysis [17,18,22].…”

Section: Related Workmentioning

confidence: 99%

Ensemble Learning for Low-Level Hardware-Supported Malware Detection

Khasawneh

Özsoy

Donovick

et al. 2015

Research in Attacks, Intrusions, and Defenses

View full text Add to dashboard Cite

Abstract. Recent work demonstrated hardware-based online malware detection using only low-level features. This detector is envisioned as a first line of defense that prioritizes the application of more expensive and more accurate software detectors. Critical to such a framework is the detection performance of the hardware detector. In this paper, we explore the use of both specialized detectors and ensemble learning techniques to improve performance of the hardware detector. The proposed detectors reduce the false positive rate by more than half compared to a single detector, while increasing the detection rate. We also contribute approximate metrics to quantify the detection overhead, and show that the proposed detectors achieve more than 11x reduction in overhead compared to a software only detector (1.87x compared to prior work), while improving detection time. Finally, we characterize the hardware complexity by extending an open core and synthesizing it on an FPGA platform, showing that the overhead is minimal.

show abstract

Section: Related Workmentioning

confidence: 99%

Ensemble Learning for Low-Level Hardware-Supported Malware Detection

Khasawneh

Özsoy

Donovick

et al. 2015

Research in Attacks, Intrusions, and Defenses

View full text Add to dashboard Cite

show abstract

“…(2) Performance comparison: next, we compare the detection performance of Mlifdect with some state-of-theart approaches, including Drebin [3] and emphFest [4], as well as two detection approaches presented by Yerima et al One is based on improved eigenface algorithm [18] and another is based on ensemble learning [6], which we call them Eigenspace and HAEL.…”

Section: Discussionmentioning

confidence: 99%

“…malware. In particularly, we consider Eigenspace [18], HAEL [6], Fest [4], and Drebin [3]. Moreover, we also compare Mlifdect with several single classification algorithms, such as KNN and random forest.…”

Section: Detection With Different Thresholdsmentioning

confidence: 99%

“…However, these prior works only used one single classification algorithm, which makes it hard to prove which algorithm is most suitable for Android malware detection. Alternatively, Yerima et al [6]. collected 179 features including API calls and permissions, and they chose random forest, a kind of ensemble learning algorithms, to achieve high detection accuracy.…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Mlifdect: Android Malware Detection Based on Parallel Machine Learning and Information Fusion

Wang

Zhang

et al. 2017

Security and Communication Networks

View full text Add to dashboard Cite

In recent years, Android malware has continued to grow at an alarming rate. More recent malicious apps' employing highly sophisticated detection avoidance techniques makes the traditional machine learning based malware detection methods far less effective. More specifically, they cannot cope with various types of Android malware and have limitation in detection by utilizing a single classification algorithm. To address this limitation, we propose a novel approach in this paper that leverages parallel machine learning and information fusion techniques for better Android malware detection, which is named Mlifdect. To implement this approach, we first extract eight types of features from static analysis on Android apps and build two kinds of feature sets after feature selection. Then, a parallel machine learning detection model is developed for speeding up the process of classification. Finally, we investigate the probability analysis based and Dempster-Shafer theory based information fusion approaches which can effectively obtain the detection results. To validate our method, other state-of-the-art detection works are selected for comparison with real-world Android apps. The experimental results demonstrate that Mlifdect is capable of achieving higher detection accuracy as well as a remarkable run-time efficiency compared to the existing malware detection solutions.

show abstract

“…Contrary to previous machine learning based dynamic detection work, we attempt to utilize real phones (devices) for automated feature extraction in order to avoid the problem of anti-emulator techniques being employed by Android malware to evade detection. Some previous machine learning based Android malware detection works such as [16], , [33], [13], [32], have considered API calls and Intents in their studies. However, unlike our work, these are based on static feature extraction and thus could be affected by obfuscation.…”

Section: Related Workmentioning

confidence: 99%

EMULATOR vs REAL PHONE

Alzaylaee

Yerima

Sezer

2017

Proceedings of the 3rd ACM on International Workshop on Security and Privacy Analytics

Self Cite

View full text Add to dashboard Cite

The Android operating system has become the most popular operating system for smartphones and tablets leading to a rapid rise in malware. Sophisticated Android malware employ detection avoidance techniques in order to hide their malicious activities from analysis tools. These include a wide range of anti-emulator techniques, where the malware programs attempt to hide their malicious activities by detecting the emulator. For this reason, countermeasures against antiemulation are becoming increasingly important in Android malware detection. Analysis and detection based on real devices can alleviate the problems of anti-emulation as well as improve the effectiveness of dynamic analysis. Hence, in this paper we present an investigation of machine learning based malware detection using dynamic analysis on real devices. A tool is implemented to automatically extract dynamic features from Android phones and through several experiments, a comparative analysis of emulator based vs. device based detection by means of several machine learning algorithms is undertaken. Our study shows that several features could be extracted more effectively from the on-device dynamic analysis compared to emulators. It was also found that approximately 24% more apps were successfully analysed on the phone. Furthermore, all of the studied machine learning based detection performed better when applied to features extracted from the on-device dynamic analysis.

show abstract

High accuracy android malware detection using ensemble learning

Cited by 158 publications

References 34 publications

Ensemble Learning for Low-Level Hardware-Supported Malware Detection

Ensemble Learning for Low-Level Hardware-Supported Malware Detection

Mlifdect: Android Malware Detection Based on Parallel Machine Learning and Information Fusion

EMULATOR vs REAL PHONE

Contact Info

Product

Resources

About