MobiSentry: Towards Easy and Effective Detection of Android Malware on Smartphones

Abstract

Android platform is increasingly targeted by attackers due to its popularity and openness. Traditional defenses to malware are largely reliant on expert analysis to design the discriminative features manually, which are easy to bypass with the use of sophisticated detection avoidance techniques. Therefore, more effective and easy-to-use approaches for detection of Android malware are in demand. In this paper, we present MobiSentry, a novel lightweight defense system for malware classification and categorization on smartphones. Besides conventional static features such as permissions and API calls, MobiSentry also employs the N-gram features of operation codes (n-opcode). We present two comprehensive performance comparisons among several state-of-the-art classification algorithms with multiple evaluation metrics: (1) malware detection on 184,486 benign applications and 21,306 malware samples, and (2) malware categorization on DREBIN, the largest labeled Android malware datasets. We utilize the ensemble of these supervised classifiers to design MobiSentry, which outperforms several related approaches and gives a satisfying performance in the evaluation. Furthermore, we integrate MobiSentry with Android OS that enables smartphones with Android to extract features and to predict whether the application is benign or malicious. Experimental results on real smartphones show that users can easily and effectively protect their devices against malware through this system with a small run-time overhead.

A comprehensive review on permissions-based Android malware detection

“…However, note that 46.5% of the total work utilized the DT classifier without mentioning the particular type. With the help of the information highlighted by the figure, we can conclude that the five most used detection models include SVM [64]- [66], DT [110]- [115], RF [124]- [131] from Ensemble learning, NB [165]- [167] from Bayesian Learning and KNN [73]- [75] with 98 (49%), 93 (46.5%), 80 (40%), 77 (38.5%) and 53 (26.5%) corresponding number (percentage) of studies that involved the classifiers mentioned respectively. It is worth noting that due to the growing popularity of deep learning, researchers have extensively started using neural network classifiers in their work.…”

“…Malware datasets used Rovelli et al [115] Genome, Contagio Arp et al [116] Genome,FakeInstaller, GoldDream 27 , GingerMaster 28 , DroidKungFu 29 Yerima et al [117] McAfee Kang et al [118] VirusShare, Contagio, Malware.lu Zhao et al [119] Drebin Qiao et al [120] Genome Chen et al [121] 360 APKs 30 , MobiSec Lab Website 31 , [217] Demertzis et al [122] Magnum-Research 32 Verma et al [123] Contagio, malware forums , security blogs, Genome Wang et al [124] VirusTotal Tang et al [125] Genome, Drebin Wang et al [126] Drebin, Genome Li et al [127] Drebin Bhattacharya et al [128] Contagio Xie et al [129] Genome, VirusShare, Drebin Xie et al [130] Genome, VirusShare, Drebin, antivirus companies Ren et al [131] Anzhi, AndroTotal, Drebin Tao et al [132] VirusShare, Contagio Namrud et al [133] AndroZoo Alswaina et al [134] -Qiu et al [135] -Zhu et al [136] ViruShare Feng et al [137] No Malware Aonzo et al [138] AndroZoo Urooj et al [139] MalDroid [225], DefenseDroid 33 and a small own generated dataset Wang et al [140] No malware Wang et al [141] FakeInst, Opfake, FakeInstaller, Droid-KungFu, GinMaster, Plankton Zhang et al [142] No malware Kesswani et al [143] No malware Ibrahim et al [144] CICMalDroid 2020 Arshad et al [145] Drebin Yuan et al [146] Genome, Contagio Zhou et al [147] Genome Cilleruelo et al [148] Malware selected on the basis of lifespan criteria from Google Play Store ...…”

DeepMDFC: A deep learning based android malware detection and family classification method

“…Authors selected vital features through information gain and assigned weights to selected features according to their importance. Ren et al 25 evaluated the effectiveness of n ‐gram opcodes along with conventional static features for classifying and categorizing malicious Android applications. MAMA presented by Sanz et al utilized various static features for example, permissions, hardware components, and software of applications to detect Android malware 26 .…”

Machine-Learning based analysis and classification of Android malware signatures

“…In [24] the authors consider malware and adware separately in their Android malware detection system. Also, the authors of [25] acknowledge how adware is not equal to other type of malware and can affect malware detection results. Finally, Yang et al argue in their work [26] that adware should be separated from "truly malicious apps" to provide undisputed malware detection results due to the controversy among AVs on whether to label an adware sample.…”