Smart malware detection on Android

Abstract

Nowadays, because of its increased popularity, Android is target to a growing number of attacks and malicious applications, with the purpose of stealing private information and consuming credit by subscribing to premium services. Most of the current commercial antivirus solutions use static signatures for malware detection, which may fail to detect different variants of the same malware and zero‐day attacks. In this paper, we present a behavior‐based, dynamic analysis security solution, called Android Malware Detection System, for detecting both well‐known and zero‐day malware. The proposed solution uses a machine learning classifier in order to differentiate between the behaviors of legitimate and malicious applications. In addition, it uses the application statistics for determining its reputation. The final decision is based on a combination of the classifier's result and the application reputation. The solution includes a unique and extensive set of data collectors, which gather application‐specific data that describe the behavior of the monitored application. We evaluated our solution on a set of legitimate and malicious applications and obtained a high accuracy of 0.985. Our system is able to detect zero‐day malware samples that are not detected by current commercial solutions. Our solution outperforms other similar solutions running on mobile devices. Copyright © 2015 John Wiley & Sons, Ltd.

Key features for the characterization of Android malware families

“…Up to now, a growing effort has been devoted to Android malware [10]. From an intrusion detection perspective, many machine learning algorithms have been applied to differentiate between legitimate and malicious Android apps, such as classifiers [11], [12], [13], [14] and clustering [15]. Under a similar perspective, some other approaches based on knowledge discovery [16], visual inspection [17], and weighted similarity matching of logs [18] have been also proposed.…”

Detection of Anomalous Behavior in Modern Smartphones Using Software Sensor-Based Data

“…The initial data was collected through the framework described in [1,2] which relies on a data collection framework within the smartphone and the installation of an additional application that performs the real-time monitoring while running in background (called AMDS in [2]). The application pool was built by using both reputable applications (the ones that the phone came with, top Google Play applications, or similar stores for other markets such as SlideMe [4]) as well as known malware applications.…”

“…After this step the target application was uninstalled, to prevent both reaching lack of storage space during the experiment as well as preventing some applications from influencing one another and the next target application from the list was installed and experimented with. During the training phase a data of monitoring each target application was stored locally in the phone, and during testing phase a different pool of applications was used, each application installed, monitored, local data stored updated, while the real-time monitoring application described at large in [2], was running in background, and if abnormal behavior was detected this application would be prevented from running, it would be flagged to the user who would make the final decision (to continue preventing the application from running or allow it to continue) on a case by case basis.…”

“…This level of openness into the source code of the stack allows access into both public and non-public API information, allowing for the purpose of our research access into the smartphone sensors. It also consists of the basis of the infrastructure of data collection architecture (used to obtain the raw data behind the initial dataset for this paper) described in [1] with an application for malware detection [2], using measurable events collected for a set of Android applications including both samples obtained from scientists in the field (Malgenome application set described by the authors of [3]) as well as more recent Internet sources (including [4,5] and Google Play for benign Android samples).…”

Secured Cloud for Enterprise Computing

“…Malware, today, is increasingly sophisticated and avoids detection by changing its patterns each time it runs [30]. The changing of patterns makes detection nearly impossible.…”