.png){kind=icon}
.png){kind=icon}
Return
Semantic characterization of android malware through runtime system call analysis
.png){kind=icon}
PRE
AI
DOI：10.1016/j.jisa.2026.104406.png)
.png){kind=icon}
Original request for help.png){kind=icon}
Share.png){kind=icon}
Save
Abstract
En 中文
The popularity and adoption of smartphones, especially on the Android platform, has led to the rapid growth of malware. Meanwhile, modern malware increasingly employs obfuscation and evasion techniques to bypass signature-based detection models. Malware characterization is essential as it enables understanding of the tactics and techniques that aid in threat attribution and detection of novel variants. Existing malware characterization methods often rely on static features and manually predefined rules to map techniques and procedures, which often leads to inconsistent mapping. In this work, a malware characterization approach is developed which uses system calls to capture the behavior of malicious applications. To provide lower-level abstraction, the system calls are divided into five distinct families. An autoencoder is trained on execution traces to identify the system calls characteristic to malicious operations. In addition, a fine-tuned Mistral model is used to generate system call descriptions, which are mapped with MITRE ATT&CK techniques using Sentence-BERT embeddings. We experimented with 241 different malware families, which shows that our approach achieves high-quality semantic mappings, with a cosine similarity of 0.912, BLEU score of 0.445, and BERT F1 score of 0.827. It is observed that, at the system level, malware executes system calls (across all five categories) at much higher frequencies than benign applications. Also, different malware families show distinct behavioral characteristics, for example, ransomware relied heavily on file system operations, while adware and SMSware emphasized process control. On the top, SMC-SAM achieves better detection accuracy (97.54%) as compared to other approaches.
Keywords:
Android malware
system call analysis
malware characterization
MITRE ATT&CK
autoencoder
Journal
IF:
3.7
Papers:
1.9K
Citations:
4.9K
Organization
No organization information available