Cross-device behavioral consistency: Benchmarking and implications for effective android malware detection
Most of the proposed solutions using dynamic features for Android malware detection collect and test their systems using a single and particular data collection device, either a real device or an emulator. The results obtained using these particular devices are then generalized to any Android platfo...
| Main Authors: | , |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
Elsevier
2022-09-01
|
| Series: | Machine Learning with Applications |
| Subjects: | |
| Online Access: | http://www.sciencedirect.com/science/article/pii/S2666827022000561 |
| _version_ | 1817995053272924160 |
|---|---|
| author | Alejandro Guerra-Manzanares Martin Välbe |
| author_facet | Alejandro Guerra-Manzanares Martin Välbe |
| author_sort | Alejandro Guerra-Manzanares |
| collection | DOAJ |
| description | Most of the proposed solutions using dynamic features for Android malware detection collect and test their systems using a single and particular data collection device, either a real device or an emulator. The results obtained using these particular devices are then generalized to any Android platform. This extensive generalization is based on the assumption of consistent behavior of apps across devices. This study performs an extensive benchmarking of this assumption for system calls, executing Android malware and benign samples under the same conditions in 9 different collection devices, including real and virtual devices. The results indicate the existence of significant differences between real devices and emulators in system calls usage and, consequently, in the collected behavioral profiles obtained from running the same set of applications on different devices. Furthermore, the impact of these differences on machine learning-based malware detection models is evaluated. In this regard, a significant degenerative effect on the detection performance of the model is produced when data collected on different devices are used in the training and testing sets. Therefore, the empirical findings do not support the assumption of cross-device consistent behavior of Android apps when system calls are used as descriptive features. |
| first_indexed | 2024-04-14T02:00:07Z |
| format | Article |
| id | doaj.art-76ce6ec745914d368617ca3d1909017d |
| institution | Directory Open Access Journal |
| issn | 2666-8270 |
| language | English |
| last_indexed | 2024-04-14T02:00:07Z |
| publishDate | 2022-09-01 |
| publisher | Elsevier |
| record_format | Article |
| series | Machine Learning with Applications |
| spelling | doaj.art-76ce6ec745914d368617ca3d1909017d2022-12-22T02:18:52ZengElsevierMachine Learning with Applications2666-82702022-09-019100357Cross-device behavioral consistency: Benchmarking and implications for effective android malware detectionAlejandro Guerra-Manzanares0Martin Välbe1Corresponding author.; Department of Software Science, Tallinn University of Technology, EstoniaDepartment of Software Science, Tallinn University of Technology, EstoniaMost of the proposed solutions using dynamic features for Android malware detection collect and test their systems using a single and particular data collection device, either a real device or an emulator. The results obtained using these particular devices are then generalized to any Android platform. This extensive generalization is based on the assumption of consistent behavior of apps across devices. This study performs an extensive benchmarking of this assumption for system calls, executing Android malware and benign samples under the same conditions in 9 different collection devices, including real and virtual devices. The results indicate the existence of significant differences between real devices and emulators in system calls usage and, consequently, in the collected behavioral profiles obtained from running the same set of applications on different devices. Furthermore, the impact of these differences on machine learning-based malware detection models is evaluated. In this regard, a significant degenerative effect on the detection performance of the model is produced when data collected on different devices are used in the training and testing sets. Therefore, the empirical findings do not support the assumption of cross-device consistent behavior of Android apps when system calls are used as descriptive features.http://www.sciencedirect.com/science/article/pii/S2666827022000561BenchmarkAndroid malwareMalware detectionMalware behaviorSystem callsReal device |
| spellingShingle | Alejandro Guerra-Manzanares Martin Välbe Cross-device behavioral consistency: Benchmarking and implications for effective android malware detection Machine Learning with Applications Benchmark Android malware Malware detection Malware behavior System calls Real device |
| title | Cross-device behavioral consistency: Benchmarking and implications for effective android malware detection |
| title_full | Cross-device behavioral consistency: Benchmarking and implications for effective android malware detection |
| title_fullStr | Cross-device behavioral consistency: Benchmarking and implications for effective android malware detection |
| title_full_unstemmed | Cross-device behavioral consistency: Benchmarking and implications for effective android malware detection |
| title_short | Cross-device behavioral consistency: Benchmarking and implications for effective android malware detection |
| title_sort | cross device behavioral consistency benchmarking and implications for effective android malware detection |
| topic | Benchmark Android malware Malware detection Malware behavior System calls Real device |
| url | http://www.sciencedirect.com/science/article/pii/S2666827022000561 |
| work_keys_str_mv | AT alejandroguerramanzanares crossdevicebehavioralconsistencybenchmarkingandimplicationsforeffectiveandroidmalwaredetection AT martinvalbe crossdevicebehavioralconsistencybenchmarkingandimplicationsforeffectiveandroidmalwaredetection |