Android Fragmentation in Malware Detection

doi:10.1016/j.cose.2019.101573

Return

Android Fragmentation in Malware Detection

2019-11-01

Long Nguyen-Vu

Jinung Ahn

Souhwan Jung *

DOI：10.1016/j.cose.2019.101573

Original

Save

View PDF

Abstract

En 中文

Differences between Android versions affect not only application developers but also make the task of securing Android harder, as it is not easy to keep track of updates. In this paper, we first systematically analyze the Android framework, which includes APIs and enforced manifest permissions to realize the inconsistency currently exists in the OS. To carry out the analysis, fine-grained machine learning-based classifiers are constructed out of predefined malicious-benign datasets to perform the task of malware detection. We propose the use of multiple feature vectors to build machine learning-based models targeting different ranges of Android API levels. As a result, the process of choosing optimal learning features becomes more efficient while avoids complicating the machine learning model unnecessarily. Also, top features extracted from machine learning models provide us the insights about how important each of them is to specific Android versions. We eventually observe the improvement of detection rates in those fine-grained classifiers compared to a single classifier. (C) 2019 The Authors. Published by Elsevier Ltd.

Keywords:

Android security

Malware analysis

API level

Android fragmentation

Machine learning

AI Summary

Key information extracted from the uploaded paper, including a brief overview, abstract, background, key highlights, visual analysis, and future outlook.