Browse > Article
http://dx.doi.org/10.3837/tiis.2017.02.018

A Risk Classification Based Approach for Android Malware Detection  

Ye, Yilin (Institute of Command Information System, PLA University of Science and Technology)
Wu, Lifa (Institute of Command Information System, PLA University of Science and Technology)
Hong, Zheng (Institute of Command Information System, PLA University of Science and Technology)
Huang, Kangyu (Institute of Command Information System, PLA University of Science and Technology)
Publication Information
KSII Transactions on Internet and Information Systems (TIIS) / v.11, no.2, 2017 , pp. 959-981 More about this Journal
Abstract
Existing Android malware detection approaches mostly have concentrated on superficial features such as requested or used permissions, which can't reflect the essential differences between benign apps and malware. In this paper, we propose a quantitative calculation model of application risks based on the key observation that the essential differences between benign apps and malware actually lie in the way how permissions are used, or rather the way how their corresponding permission methods are used. Specifically, we employ a fine-grained analysis on Android application risks. We firstly classify application risks into five specific categories and then introduce comprehensive risk, which is computed based on the former five, to describe the overall risk of an application. Given that users' risk preference and risk-bearing ability are naturally fuzzy, we design and implement a fuzzy logic system to calculate the comprehensive risk. On the basis of the quantitative calculation model, we propose a risk classification based approach for Android malware detection. The experiments show that our approach can achieve high accuracy with a low false positive rate using the RandomForest algorithm.
Keywords
Android; malware detection; risk; machine learning; fuzzy logic;
Citations & Related Records
연도 인용수 순위
  • Reference
1 Hassana, Doaa, Matthew Might, and Vivek Srikumar, "A Similarity-Based Machine Learning Approach for Detecting Adversarial Android Malware," Technical report UUCS-14-002, School of Computing, University of Utah, 2014.
2 Droidbox, http:code.google.com/p/droidbox.
3 Nauman M, Khan S, Zhang X and Seifert JP, "Beyond Kernel-Level Integrity Measurement: Enabling Remote Attestation for the Android Platform," in Proc. of Trust and Trustworthy Computing, Third International Conference, TRUST 2010, Berlin, Germany, June 21-23, 2010.
4 Song F, Touili T., "Model-Checking for Android Malware Detection," Programming Languages and Systems. Springer International Publishing, 216-235, 2014.
5 Sakamoto S, Okuda K, Nakatsuka R and Yamauchi T., "DroidTrack: tracking and visualizing information diffusion for preventing information leakage on Android," Journal of Internet Services and Information Security (JISIS) 4.2, 55-69, 2014.   DOI
6 Bugiel S, Davi L, Dmitrienko A, Fischer T and Sadeghi AR., "XManAndroid: A new Android evolution to mitigate privilege escalation attacks," Technical Report, Technische Universitat Darmstadt, TR-2011-04, 2011.
7 Conti M, Nguyen V T N, Crispo B., "CRePE: Context-Related Policy Enforcement for Android," in Proc. of Information Security, International Conference, ISC 2010, Boca Raton, Fl, Usa, October 25-28, 2010, Revised Selected Papers. 331-345, 2010.
8 Zhou Y, Zhang X, Jiang X and Freeh W V., "Taming Information-Stealing Smartphone Applications (on Android)," in Proc. of Trust and Trustworthy Computing International Conference, Trust 2011, Pittsburgh, Pa, Usa, June 22-24, 2011. Proceedings. 93-107, 2011.
9 Rastogi V, Chen Y, Enck W., "AppsPlayground: automatic security analysis of smartphone applications," in Proc. of ACM Conference on Data and Application Security and Privacy. 209-220, 2013.
10 Yan, Lok-Kwong, and Heng Yin, "DroidScope: Seamlessly Reconstructing the OS and Dalvik Semantic Views for Dynamic Android Malware Analysis," USENIX security symposium. 2012.
11 Sun, Mingshen, J. C. S. Lui and X. Jiang, "Design and implementation of an Android host-based intrusion prevention system," in Proc. of the 30th Annual Computer Security Applications Conference. ACM, pp.226-235, 2014.
12 Feng Y, Anand S, Dillig I, Aiken A., "Apposcopy: semantics-based detection of Android malware through static analysis," The ACM Sigsoft International Symposium, 576-587, 2014.
13 Dietz M, Shekhar S, Pisetsky Y, Shu AandWallach DS., "Quire: lightweight provenance for smart phone operating systems," Dissertations & Theses, 23-23, 2011.
14 Reina A, Fattori A, Cavallaro L., "A System Call-Centric Analysis and Stimulation Technique to Automatically Reconstruct Android Malware Behaviors," Eurosec, 2014.
15 Aafer Y, Du W and Yin H., "DroidAPIMiner: Mining API-Level Features for Robust Malware Detection in Android," Security and Privacy in Communication Networks. Springer International Publishing, 86-103, 2013.
16 Blasing T, Batyuk L, Schmidt A D, Camtepe SA., "An Android Application Sandbox system for suspicious software detection," in Proc. of International Conference on Malicious and Unwanted Software. IEEE, S166, 2010.
17 Enck W, Ongtang M and Mcdaniel P, "On lightweight mobile phone application certification," Computer and Communications Security, 2009.
18 Liang, Shuang, and Xiaojiang Du, "Permission-combination-based scheme for Android mobile malware detection," in Proc. of the 2014 IEEE International Conference on Communications, Sidney, Australia, pp. 2301-2306, June 2014.
19 Zhou, W., Zhou, Y., Jiang X. and Ning, P., "DroidMoss: Detecting repackaged smartphone applications in third-party Android marketplaces," in Proc. of the second ACM conference on Data and Application Security and Privacy, CODASPY'12, 2012.
20 Grace M, Zhou Y, Zhang Q, Zou S and Jiang X., "RiskRanker: scalable and accurate zero-day android malware detection," in Proc. of International Conference on Mobile Systems, Applications, and Services. ACM, 281-294, 2012.
21 Sarma B P, Li N, Gates C, Potharaju R and Nita-Rotaru C., "Android permissions: A perspective combining risks and benefits," in Proc. of Acm Symposium on Access Control Models & Technologies Ser Sacmat', 13-22, 2012.
22 Arp D, Gascon H, Rieck K, Spreitzenbarth M and Hubner M., "DREBIN: Effective and Explainable Detection of Android Malware in Your Pocket," Network and Distributed System Security Symposium. 2014.
23 Androguard. https://code.google.com/p/androguard/.
24 Cesare S, Xiang Y., "Classification of malware using structured control flow," Eighth Australasian Symposium on Parallel and Distributed Computing. Australian Computer Society, Inc. 61-70, 2010.
25 Peng H, Gates C, Sarma B, Li N and Qi Y., "Using probabilistic generative models for ranking risks of Android apps," in Proc. of Conference on Computer and Communications Security. 241-252, 2012.
26 Driankov, Dimiter, Hans Hellendoorn, and Michael Reinfrank, "An introduction to fuzzy control," Springer Science & Business Media, 2013.
27 Weka, http://www.cs.waikato.ac.nz/ml/weka.
28 Appchina, http://www.appchina.com.
29 Anzhi, http://www.anzhi.com.
30 Virus share, http://www.virusshare.com.
31 Johnson R, Wang Z, Gagnon C and Stavrou, "A. Analysis of Android Applications' Permissions," in Proc. of IEEE Sixth International Conference on Software Security and Reliability Companion. 45-46, 2012.
32 IDC: Smartphone OS Market share 2015,http://www.idc.com/prodserv/smartphone-os-market-share.jsp
33 360: mobile phone security situation report 2014, http://www.199it.com/archives/325900.html
34 Wei X, Gomez L, Neamtiu I. and Faloutsos M., "Permission evolution in the Android ecosystem," in Proc. of Computer Security Applications Conference, 31-40, 2012.
35 Au K W Y, Zhou Y F, Huang Z, Lie D., "PScout: analyzing the Android permission specification," in Proc. of the 2012 ACM conference on Computer and communications security. ACM, 217-228, 2012.
36 Barrera D, Kayacik, H. G, Van Oorschot P C and Somayaji A., "A methodology for empirical analysis of permission-based security models and its application to android," in Proc. of ACM Conference on Computer and Communications Security, CCS 2010, Chicago, Illinois, USA, October. 73-84, 2010.
37 Felt A P, Chin E, Hanna S, Song D and Wagner D., "Android permissions demystified," in Proc. of ACM Conference on Computer and Communications Security, CCS 2011, Chicago, Illinois, USA, October. 627-638, 2011.
38 Nauman M, Khan S, Zhang X., "Apex: Extending Android Permission Model and Enforcement with User-defined Runtime Constraints," in Proc. of ACM Symposium on Information, Computer and Communications Security, ASIACCS 2010, Beijing, China, April. 328-332, 2010.
39 Ongtang M, Mclaughlin S, Enck W and McDaniel P., "Semantically Rich Application-Centric Security in Android," Security & Communication Networks, 5(6):658-673, 2009.   DOI
40 Felt A P, Wang H J, Moshchuk A, Hanna S and Chin E., "Permission re-delegation: attacks and defenses," Usenix Conference on Security. USENIX Association, 22-22, 2011.
41 Gascon H, Yamaguchi F, Arp D and Rieck K., "Structural detection of android malware using embedded call graphs," in Proc. of ACM Workshop on Security and Artificial Intelligence. 45-54, 2013.
42 Suarez-Tangil G, Tapiador J E, Peris-Lopez P, Blasco J., "Dendroid : A text mining approach to analyzing and classifying code structures in Android malware families," Expert Systems with Applications, 41(4):1104-1117, 2013.   DOI
43 Zhou Y, Wang Z, Zhou W and Jiang X., "Hey, You, Get Off of My Market: Detecting Malicious Apps in Official and Alternative Android Markets," in Proc. of Annual Network & Distributed System Security Symposium, 2012.
44 Yuan Z, Lu Y, Wang Z, Xue Y., "Droid-Sec: deep learning in android malware detection," ACM Sigcomm Computer Communication Review, 44(4):371-372, 2014.   DOI
45 Zhang Y, Yang M, Xu B, Yang Z and Gu G., "Vetting undesirable behaviors in android apps with permission use analysis," Computer and Communications Security, 9:611-622, 2013.
46 Lindorfer M, Neugschwandtner M, Weichselbaum L and Fratantonio Y, "ANDRUBIS -- 1,000,000 Apps Later: A View on Current Android Malware Behaviors," in Proc. of Third International Workshop on Building Analysis Datasets and Gathering Experience Returns for Security, IEEE Computer Society, 3-17, 2014.
47 Enck W, Gilbert P, Chun B-G, McDaniel P, Sheth A., "TaintDroid: An Information-Flow Tracking System for Realtime Privacy Monitoring on Smartphones," ACM Transactions on Computer Systems, 32(2):393-407, 2014.