返回
Monet: A User-Oriented Behavior-Based Malware Variants Detection System for Android
DOI:10.1109/TIFS.2016.2646641.png)
摘要
En 中文
Android, the most popular mobile OS, has around 78% of the mobile market share. Due to its popularity, it attracts many malware attacks. In fact, people have discovered around 1 million new malware samples per quarter, and it was reported that over 98% of these new malware samples are in fact derivatives (or variants) from existing malware families. In this paper, we first show that runtime behaviors of malware's core functionalities are in fact similar within a malware family. Hence, we propose a framework to combine runtime behavior with static structures to detect malware variants. We present the design and implementation of MONET, which has a client and a backend server module. The client module is a lightweight, in-device app for behavior monitoring and signature generation, and we realize this using two novel interception techniques. The backend server is responsible for large scale malware detection. We collect 3723 malware samples and top 500 benign apps to carry out extensive experiments of detecting malware variants and defending against malware transformation. Our experiments show that MONET can achieve around 99% accuracy in detecting malware variants. Furthermore, it can defend against ten different obfuscation and transformation techniques, while only incurs around 7% performance overhead and about 3% battery overhead. More importantly, MONET will automatically alert users with intrusion details so to prevent further malicious behaviors.
Keyword:
Malware detection
android
runtime behavior
static structure
AI总结
对已上传原文的论文进行重点信息的提取,主要内容包括:简要概述、研究摘要、背景介绍、关键亮点、图文解析、展望与总结。
期刊
IF:
8
论文数:
5.2K
被引数:
2.3W
机构
引用论文
Copper nanoparticle-deposited graphite sheets for highly thermally conductive polymer composites with reduced interfacial thermal resistance用于降低界面热阻的高导热聚合物复合材料的铜纳米颗粒沉积石墨片
Ball Milling Treatment of Black Dross for Selective Dissolution of Alumina in Sodium Hydroxide Leaching
Processes
IF0

