Three-Phase Detection and Classification for Android Malware Based on Common Behaviors
Android is one of the most popular operating systems used in mobile devices. Its popularity also renders it a common target for attackers. We propose an efficient and accurate three-phase behavior-based approach for detecting and classifying malicious Android applications. In the proposedapproach, t...
| Main Authors: | , |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
Croatian Communications and Information Society (CCIS)
2016-09-01
|
| Series: | Journal of Communications Software and Systems |
| Subjects: | |
| Online Access: | https://jcomss.fesb.unist.hr/index.php/jcomss/article/view/80 |
| _version_ | 1818020380344844288 |
|---|---|
| author | Ying-Dar Lin Chun-Ying Huang |
| author_facet | Ying-Dar Lin Chun-Ying Huang |
| author_sort | Ying-Dar Lin |
| collection | DOAJ |
| description | Android is one of the most popular operating systems used in mobile devices. Its popularity also renders it a common target for attackers. We propose an efficient and accurate three-phase behavior-based approach for detecting and classifying malicious Android applications. In the proposedapproach, the first two phases detect a malicious application and the final phase classifies the detected malware. The first phase quickly filters out benign applications based on requested permissions and the remaining samples are passed to the slower second phase, which detects malicious applications based on system call sequences. The final phase classifies malware into known or unknown types based on behavioral or permission similarities. Our contributions are three-fold: First, we propose a self-contained approach for Android malware identification and classification. Second, we show that permission requests from an Application are beneficial to benign application filtering. Third, we show that system call sequences generated from an application running inside a virtual machine can be used for malware detection. The experiment results indicate that the multi-phase approach is more accurate than the single-phase approach. The proposed approach registered true positive and false positive rates of 97% and 3%, respectively. In addition, more than 98% of the samples were correctly classified into known or unknown types of malware based on permission similarities.We believe that our findings shed some lights on future development of malware detection and classification. |
| first_indexed | 2024-04-14T08:05:13Z |
| format | Article |
| id | doaj.art-5720f2cf95b74e89ac4d964f0cbdad69 |
| institution | Directory Open Access Journal |
| issn | 1845-6421 1846-6079 |
| language | English |
| last_indexed | 2024-04-14T08:05:13Z |
| publishDate | 2016-09-01 |
| publisher | Croatian Communications and Information Society (CCIS) |
| record_format | Article |
| series | Journal of Communications Software and Systems |
| spelling | doaj.art-5720f2cf95b74e89ac4d964f0cbdad692022-12-22T02:04:47ZengCroatian Communications and Information Society (CCIS)Journal of Communications Software and Systems1845-64211846-60792016-09-01123157165Three-Phase Detection and Classification for Android Malware Based on Common BehaviorsYing-Dar LinChun-Ying HuangAndroid is one of the most popular operating systems used in mobile devices. Its popularity also renders it a common target for attackers. We propose an efficient and accurate three-phase behavior-based approach for detecting and classifying malicious Android applications. In the proposedapproach, the first two phases detect a malicious application and the final phase classifies the detected malware. The first phase quickly filters out benign applications based on requested permissions and the remaining samples are passed to the slower second phase, which detects malicious applications based on system call sequences. The final phase classifies malware into known or unknown types based on behavioral or permission similarities. Our contributions are three-fold: First, we propose a self-contained approach for Android malware identification and classification. Second, we show that permission requests from an Application are beneficial to benign application filtering. Third, we show that system call sequences generated from an application running inside a virtual machine can be used for malware detection. The experiment results indicate that the multi-phase approach is more accurate than the single-phase approach. The proposed approach registered true positive and false positive rates of 97% and 3%, respectively. In addition, more than 98% of the samples were correctly classified into known or unknown types of malware based on permission similarities.We believe that our findings shed some lights on future development of malware detection and classification.https://jcomss.fesb.unist.hr/index.php/jcomss/article/view/80Androidbehavioral analysispermissionsmalwaresystem call sequences |
| spellingShingle | Ying-Dar Lin Chun-Ying Huang Three-Phase Detection and Classification for Android Malware Based on Common Behaviors Journal of Communications Software and Systems Android behavioral analysis permissions malware system call sequences |
| title | Three-Phase Detection and Classification for Android Malware Based on Common Behaviors |
| title_full | Three-Phase Detection and Classification for Android Malware Based on Common Behaviors |
| title_fullStr | Three-Phase Detection and Classification for Android Malware Based on Common Behaviors |
| title_full_unstemmed | Three-Phase Detection and Classification for Android Malware Based on Common Behaviors |
| title_short | Three-Phase Detection and Classification for Android Malware Based on Common Behaviors |
| title_sort | three phase detection and classification for android malware based on common behaviors |
| topic | Android behavioral analysis permissions malware system call sequences |
| url | https://jcomss.fesb.unist.hr/index.php/jcomss/article/view/80 |
| work_keys_str_mv | AT yingdarlin threephasedetectionandclassificationforandroidmalwarebasedoncommonbehaviors AT chunyinghuang threephasedetectionandclassificationforandroidmalwarebasedoncommonbehaviors |