RAX-ClaMal: Dynamic Android malware classification based on RAX register values

doi:10.1016/j.iot.2024.101482

RAX-ClaMal: Dynamic Android malware classification based on RAX register values

2025-03-01

0

PRE

AI

DOI：10.1016/j.iot.2024.101482

Original

Original request for help

Save

Abstract

En 中文

Detecting malware on Android remains a major challenge because malicious apps use sophisticated evasion techniques. This study presents RAX-ClaMal, a novel approach leveraging dynamic analysis of RAX (Register a Extended) register values for Android malware detection. By extracting and examining the RAX register in the data sections from Dalvik Executable (DEX) files, RAX-ClaMal monitors changes in RAX register values to identify malicious behavior. Employing the Jaccard similarity index for classification, the method achieved a precision of 95.38%, a false positive rate of 1.59%, and an average detection time of 9.54 s per sample on the CICMalDroid2020 dataset. These results underscore the potential of using register values as indicators of malicious activity within Android applications.

Keywords:

Android malware classification

Dynamic analysis

DEX file section

RAX register

RAX-ClaMal: Dynamic Android malware classification based on RAX register values

Abstract

Journal

Organization