SUIP: An Android malware detection method based on data flow features

Abstract

Currently static detection is the most commonly used in Android malware detection. Among them, the extraction of various features is particularly important. In analysing the data flow features of applications, researchers usually use taint analysis method to extract. However, this method lack intermediate process features. So in this paper, we analyse the features of Android components to obtain application data transfer features for complementing the application data flow features and build a more complete combination of data flow features. Based on this, we propose a new Android malicious application detection method—SUIP. This method complements the missing features based on taint analysis, and combines the LightGBM algorithm to build a detection model. Finally, we use the sample set in Virusshare for experiments. Compared with the traditional static detection method of Android malicious code, the result shows that our detection method has a high detection accuracy of 98.50%.

A comprehensive review on permissions-based Android malware detection

“…These features include App descriptions [109], version numbers [112], app components [116], meta information [126] and many more. Other features commonly used in combination with permissions are small file size [65], dex file [96], URLs [90], code-related information [130] etc., and they form 20.76% of the share. Hence, based on the results presented above, we answer the third Research Question that the researchers have preferred using API calls and intents the most in combination with permissions for Android malware analysis and detection.…”

“…McLauglin [68] McAfee, vendor's internal dataset Wang et al [69] Mal com1, Mal com2 and Mal Zhou [220] Grace et al [70] Github Liu et al [71] VirusShare Bayazit et al [72] CICInvesAndMal2019 Lee et al [73] Andro-AutoPsy Dataset [221] Zhu et al [74] MUDFLOW [222], VirusShare Almahmoud et al [75] CIC-AndMal2017, CIC-InvesAndMal2019, CIC-MalDroid2020 Feng et al [76] CICAndMal2017 Kandu et al [77] Genome Arora et al [78] Genome Ding et al [79] CICInvesAndMal2019 Sahin et al [80] M0Droid [223], AMD, Kaggle, [224] Idrees et al [81] Contagio, Drebin, Genome, Virus Total, theZoo, MalShare, VirusShare Khariwal et al [82] Genome, Drebin, Koodous Idrees et al [83] Contagio, VirusTotal, appsapk, Androidmob Zhu et al [15] VirusShare Bai et al [84] Drebin Taheri et al [85] Drebin, Contagio, Genome Alazab et al [86] AndroZoo, Contagio, MalShare, VirusShare, VirusTotal Mathur et al [87] Androzoo, AMD Imtiaz et al [88] CICInves AndMal2019 Liu et al [89] OmniDroid, CIC2019, CIC2020 Chen et al [90] VirusShare Guan et al [91] VirusShare Mohamed et al [92] Genome, Maldroid Varma et al [93] CICInvesAnd Mal2019 Gyunka et al [94] Genome, Contagio Taha et al [95] Drebin Peng et al [96] CICMalDroid 2020, CIC-InvesAndMal 2019, Drebin Ashwini et al [97] Drebin Jiang et al [98] Genome, Andro MalShare Wang et al [99] Information Security Lab of Peking University Rana et al …”