Identifying Android malware with system call co-occurrence matrices

Xi Xiao

doi:10.1002/ett.3016

Identifying Android malware with system call co-occurrence matrices

2016-02-03

17

PRE

AI

DOI：10.1002/ett.3016

Original request for help

Save

Abstract

En 中文

With the popularity of Android devices, mobile malware in Android has became more prevalent. Malware causes lots of harm to users, such as stealing personal information and using too much battery or CPU. Detecting mobile malware is the main task in Android security. In this work, we use a dynamic analysis method to distinguish malware with system call sequences. At first, we track the system calls of applications under different events. Then two different feature models, the frequency vector and the co-occurrence matrix, are employed to extract features from the system call sequence. Finally, we apply Adaptive Regularization Of Weight Vectors and other machine learning algorithms to identify Android malware based on the aforementioned two models, respectively. We evaluate our method with 1189 benign applications and 1227 malicious applications. The experiment results show that the co-occurrence matrix can achieve a much better detection rate than the frequency vector. Our best detection rate is 97.7per cent with false positive rate being 1.34per cent, which is better than those of the existing methods. Copyright (c) 2016 John Wiley & Sons, Ltd.

Keywords:

PERMISSION

Identifying Android malware with system call co-occurrence matrices

Abstract

AI Summary

Journal

Organization