Research of Intrusion Detection System on Android

Yuan, Fangfang; Zhai, Lidong; Cao, Yanan; Guo, Li

doi:10.1109/services.2013.77

Cited by 9 publications

(6 citation statements)

References 9 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Yuan et al . propose a malware detection framework for Android systems. The framework consists of the following components: (i) the data extraction module; (ii) the data analysis engine; and (iii) the response module.…”

Section: Related Workmentioning

confidence: 99%

“…As in Yuan et al . , the dataset uses different system metrics such as the CPU usage, the battery consumption, the number of running processes, and the network traffic via Wi‐Fi. Four experiments are performed using 40 benign applications (20 games and 20 tools) and four proof‐of‐concept malicious applications.…”

Section: Related Workmentioning

confidence: 99%

“…On the other hand, the dynamic program traces correspond to the information collected during the execution of the applications. The most popular ones are the system calls , the system metrics such as the CPU consumption and the communication activities and the power consumption .…”

Section: Introductionmentioning

confidence: 99%

“…In the algorithm aspect, the prior works have investigated different machine learning classifiers. These classifiers have been used for detecting anomalies on Android platform.…”

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations

Generative versus discriminative classifiers for android anomaly-based detection system using system calls filtering and abstraction process

Amamra

Robert

Abraham

et al. 2016

Security Comm. Networks

View full text Add to dashboard Cite

Anomaly‐based detection techniques have been widely studied in recent years. Most of these efforts have focused to improve the accuracy of these techniques. The poor accuracy performance is caused by two factors: (i) the data used for the analysis is insufficient and/or unrepresentative of the application behavior, or (ii) inappropriate algorithms are used to model the behavior of the application. In this paper, we attempt to improve anomaly‐based detection techniques by examining these two factors. First, we use system call filtering and abstraction process. This process refines the system call traces. The refined traces are compact and should be more representative of the application main behavior. Second, we use machine learning classifiers to characterize the benign behavior. Generally, there are two main categories of machine learning classifiers: generative classifiers and discriminative classifiers. In their initial training phases, the classifiers build models characterizing the benign behavior. Later on, these models are used to distinguish between different classes of data. They are simply defined by their parameters. The k‐means classifier is considered as a representative of the generative classifier category, and the support vector machine classifier as a representative of the discriminative classifier category. The efficiency of these classifiers are reviewed and compared, as well as the impact of the filtering and abstraction process on their performances is evaluated. The experimental results show that the support vector machine model outperforms the k‐means model, and the filtering and abstraction process has positive impacts on the performance of both models. Copyright © 2016 John Wiley & Sons, Ltd.

show abstract

Section: Related Workmentioning

confidence: 99%

Section: Related Workmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

“…In the algorithm aspect, the prior works have investigated different machine learning classifiers. These classifiers have been used for detecting anomalies on Android platform.…”

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

Generative versus discriminative classifiers for android anomaly-based detection system using system calls filtering and abstraction process

Amamra

Robert

Abraham

et al. 2016

Security Comm. Networks

View full text Add to dashboard Cite

show abstract

“…The system implements WiFi scanning [6], router tracking, port scanning [7], running service detection [8], virus killing [9], real-time communication [10], etc. to provide the real-time protection of mobile terminals [11].…”

Section: Introductionmentioning

confidence: 99%