MARVIN: Efficient and Comprehensive Mobile App Classification through Static and Dynamic Analysis

Lindorfer, Martina; Neugschwandtner, Matthias; Platzer, Christian

doi:10.1109/compsac.2015.103

Cited by 168 publications

(149 citation statements)

References 33 publications

Supporting

Mentioning

144

Contrasting

Unclassified

Order By: Relevance

“…[11], [2], [4]. Since some of these features have a strong correlation under different categories, these methods miss the interrelationship analysis of the feature selection step.…”

Section: Limitations Of Existing Approachesmentioning

confidence: 99%

“…However, we are planning to further refine our proof-of-concept and to release a stable and optimized prototype of SafeDroid. The source code of our proof-of-concept distributed service can be found on github 4 . Table I, where the statistics are averagely weighted on both the classes of the classification.…”

Section: A Feasibilitymentioning

confidence: 99%

“…Lindorfer et al [4] proposed MARVIN to provide a comprehensible and practical malware analysis system to empower the existing technologies, which are dealing with problems like obfuscation and dynamic code loading. The system is based on a hybrid approach, consisting of static and dynamic analysis, leveraging machine learning to provide scores for unknown android apps.…”

Section: Detection Based On Hybrid Analysismentioning

confidence: 99%

“…: with thousands of features) , as in [11], [4]. A high dimensional feature set usually generates more complex models, which typically suffer from over-fitting.…”

Section: Limitations Of Existing Approachesmentioning

confidence: 99%

“…As it will be further clear, all the approaches have several advantages and weaknesses, but considering the trade-off between usability and effectiveness, static analysis (namely the analysis of the executable code of an app) is still considered to be the most effective approach, mainly when it's bounded with the new paradigm of machine learning (ML) [2], [3], [4], [5]. The most critical step to obtain an effective and efficient ML-based system is the choice of the feature set on which the algorithms have to deal with [6].…”

Section: Introductionmentioning

confidence: 99%

See 4 more Smart Citations

SafeDroid: A Distributed Malware Detection Service for Android

Goyal

Spognardi

Dragoni

et al. 2016

2016 IEEE 9th International Conference on Service-Oriented Computing and Applications (SOCA)

View full text Add to dashboard Cite

Abstract-Android platform has become a primary target for malware. In this paper we present SafeDroid, an open source distributed service to detect malicious apps on Android by combining static analysis and machine learning techniques. It is composed by three micro-services, working together, combining static analysis and machine learning techniques. SafeDroid has been designed as a user friendly service, providing detailed feedback in case of malware detection. The detection service is optimized to be lightweight and easily updated. The feature set on which the micro-service of detection relies on on has been selected and optimized in order to focus only on the most distinguishing characteristics of the Android apps. We present a prototype to show the effectiveness of the detection mechanism service and the feasibility of the approach.

show abstract

“…[11], [2], [4]. Since some of these features have a strong correlation under different categories, these methods miss the interrelationship analysis of the feature selection step.…”

Section: Limitations Of Existing Approachesmentioning

confidence: 99%

Section: A Feasibilitymentioning

confidence: 99%

Section: Detection Based On Hybrid Analysismentioning

confidence: 99%

“…: with thousands of features) , as in [11], [4]. A high dimensional feature set usually generates more complex models, which typically suffer from over-fitting.…”

Section: Limitations Of Existing Approachesmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations

SafeDroid: A Distributed Malware Detection Service for Android

Goyal

Spognardi

Dragoni

et al. 2016

2016 IEEE 9th International Conference on Service-Oriented Computing and Applications (SOCA)

View full text Add to dashboard Cite

show abstract

Hybrid sequence‐based Android malware detection using natural language processing

Zhang

Xue

et al. 2021

Int J Intell Syst

View full text Add to dashboard Cite

Android platform has been the target of attackers due to its openness and increasing popularity. Android malware has explosively increased in recent years, which poses serious threats to Android security. Thus proposing efficient Android malware detection methods is curial in defeating malware. Various features extracted from static or dynamic analysis using machine learning have played an important role in malware detection recently. However, existing code obfuscation, code encryption, and dynamic code loading techniques can be employed to hinder systems that single based on static analysis, purely dynamic analysis systems cannot detect all potential code execution paths. To address these issues, we propose CoDroid, a sequence-based hybrid Android malware detection method, which utilizes the sequences of static opcode and dynamic system call. We treat one sequence as a sentence in the natural language processing and construct a CNN-BiLSTM-Attention classifier which consists of Convolutional Neural Networks (CNNs), the Bidirectional Long Short-Term Memory (BiLSTM) with an attention language model. We extensively evaluate CoDroid under a real-world data set and perform comprehensive analysis against other existing related detection methods. The evaluations show the effectiveness and flexibility of CoDroid across a variety of experimental settings.

show abstract

CDGDroid: Android Malware Detection Based on Deep Learning Using CFG and DFG

Ren

Qin

et al. 2018

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Android malware has become a serious threat in our daily digital life, and thus there is a pressing need to effectively detect or defend against them. Recent techniques have relied on the extraction of lightweight syntactic features that are suitable for machine learning classification, but despite of their promising results, the features they extract are often too simple to characterise Android applications, and thus may be insufficient when used to detect Android malware. In this paper, we propose CDGDroid, an effective approach for Android malware detection based on deep learning. We use the semantics graph representations, that is, control flow graph, data flow graph, and their possible combinations, as the features to characterise Android applications. We encode the graphs into matrices, and use them to train the classification model via Convolutional Neural Network (CNN). We have conducted some experiments on Marvin, Drebin, VirusShare and ContagioDump datasets to evaluate our approach and have identified that the classification model taking the horizontal combination of CFG and DFG as features offers the best performance in terms of accuracy among all combinations. We have also conducted experiments to compare our approach against Yeganeh Safaei et al.'s approach, Allix et al.'s approach, Drebin and many antivirus tools gathered in VirusTotal, and the experimental results have confirmed that our classification model gives a better performance than the others.

show abstract

MARVIN: Efficient and Comprehensive Mobile App Classification through Static and Dynamic Analysis

Cited by 168 publications

References 33 publications

SafeDroid: A Distributed Malware Detection Service for Android

SafeDroid: A Distributed Malware Detection Service for Android

Hybrid sequence‐based Android malware detection using natural language processing

CDGDroid: Android Malware Detection Based on Deep Learning Using CFG and DFG

Contact Info

Product

Resources

About