1,533 research outputs found
A Multi-view Context-aware Approach to Android Malware Detection and Malicious Code Localization
Existing Android malware detection approaches use a variety of features such
as security sensitive APIs, system calls, control-flow structures and
information flows in conjunction with Machine Learning classifiers to achieve
accurate detection. Each of these feature sets provides a unique semantic
perspective (or view) of apps' behaviours with inherent strengths and
limitations. Meaning, some views are more amenable to detect certain attacks
but may not be suitable to characterise several other attacks. Most of the
existing malware detection approaches use only one (or a selected few) of the
aforementioned feature sets which prevent them from detecting a vast majority
of attacks. Addressing this limitation, we propose MKLDroid, a unified
framework that systematically integrates multiple views of apps for performing
comprehensive malware detection and malicious code localisation. The rationale
is that, while a malware app can disguise itself in some views, disguising in
every view while maintaining malicious intent will be much harder.
MKLDroid uses a graph kernel to capture structural and contextual information
from apps' dependency graphs and identify malice code patterns in each view.
Subsequently, it employs Multiple Kernel Learning (MKL) to find a weighted
combination of the views which yields the best detection accuracy. Besides
multi-view learning, MKLDroid's unique and salient trait is its ability to
locate fine-grained malice code portions in dependency graphs (e.g.,
methods/classes). Through our large-scale experiments on several datasets
(incl. wild apps), we demonstrate that MKLDroid outperforms three
state-of-the-art techniques consistently, in terms of accuracy while
maintaining comparable efficiency. In our malicious code localisation
experiments on a dataset of repackaged malware, MKLDroid was able to identify
all the malice classes with 94% average recall
Longitudinal performance analysis of machine learning based Android malware detectors
This paper presents a longitudinal study of the performance of machine learning classifiers for Android malware detection. The study is undertaken using features extracted from Android applications first seen between 2012 and 2016. The aim is to investigate the extent of performance decay over time for various machine learning classifiers trained with static features extracted from date-labelled benign and malware application sets. Using date-labelled apps allows for true mimicking of zero-day testing, thus providing a more realistic view of performance than the conventional methods of evaluation that do not take date of appearance into account. In this study, all the investigated machine learning classifiers showed progressive diminishing performance when tested on sets of samples from a later time period. Overall, it was found that false positive rate (misclassifying benign samples as malicious) increased more substantially compared to the fall in True Positive rate (correct classification of malicious apps) when older models were tested on newer app samples
Malware detection techniques for mobile devices
Mobile devices have become very popular nowadays, due to its portability and
high performance, a mobile device became a must device for persons using
information and communication technologies. In addition to hardware rapid
evolution, mobile applications are also increasing in their complexity and
performance to cover most needs of their users. Both software and hardware
design focused on increasing performance and the working hours of a mobile
device. Different mobile operating systems are being used today with different
platforms and different market shares. Like all information systems, mobile
systems are prone to malware attacks. Due to the personality feature of mobile
devices, malware detection is very important and is a must tool in each device
to protect private data and mitigate attacks. In this paper, analysis of
different malware detection techniques used for mobile operating systems is
provides. The focus of the analysis will be on the to two competing mobile
operating systems - Android and iOS. Finally, an assessment of each technique
and a summary of its advantages and disadvantages is provided. The aim of the
work is to establish a basis for developing a mobile malware detection tool
based on user profiling.Comment: 11 pages, 6 figure
- …