Android Malware Detection via Graphlet Sampling

doi:10.1109/TMC.2018.2880731

Android Malware Detection via Graphlet Sampling

2019-12-01

21

OA

AI

DOI：10.1109/TMC.2018.2880731

Original

Save

View PDF

Abstract

En 中文

Android systems are widely used in mobile & x0026; wireless distributed systems. In the near future, Android is believed to dominate the mobile distributed environment. However, with the popularity of Android-based smartphones/tablets comes the rampancy of Android-based malware. In this paper, we propose a novel topological signature of Android apps based on the function call graphs (FCGs) extracted from their Android App PacKages (APKs). Specifically, by leveraging recent advances on graphlet mining, the proposed method fully captures the invocator-invocatee relationship at local neighborhoods in an FCG without exponentially inflating the state space. Using real benign app and malware samples, we demonstrate that our method, App topologiCal signature through graphleT Sampling (ACTS), can detect malware and identify malware families robustly and efficiently. More importantly, we demonstrate that, without augmenting the FCG with any semantic features such as bytecode-based vertex typing, local topological information captured by ACTS alone can achieve a high malware detection accuracy. Since ACTS only uses structural features, which are orthogonal to semantic features, it is expected that combining them would give a greater improvement in malware detection accuracy than combining non-orthogonal semantic features.

Keywords:

Malware

Feature extraction

Semantics

Smart phones

Java

Markov processes

Mobile computing

Android

graphlet sampling

mobile applications

mobile malware

smartphone

Android Malware Detection via Graphlet Sampling

Abstract

AI Summary

Journal

Organization