A Static Android Malware Detection Based on Actual Used Permissions Combination and API Calls

Authors: Xiaoqing Wang, Junfeng Wang, Xiaolan Zhu

Abstract:

Android operating system has been recognized by most application developers because of its good open-source and compatibility, which enriches the categories of applications greatly. However, it has become the target of malware attackers due to the lack of strict security supervision mechanisms, which leads to the rapid growth of malware, thus bringing serious safety hazards to users. Therefore, it is critical to detect Android malware effectively. Generally, the permissions declared in the AndroidManifest.xml can reflect the function and behavior of the application to a large extent. Since current Android system has not any restrictions to the number of permissions that an application can request, developers tend to apply more than actually needed permissions in order to ensure the successful running of the application, which results in the abuse of permissions. However, some traditional detection methods only consider the requested permissions and ignore whether it is actually used, which leads to incorrect identification of some malwares. Therefore, a machine learning detection method based on the actually used permissions combination and API calls was put forward in this paper. Meanwhile, several experiments are conducted to evaluate our methodology. The result shows that it can detect unknown malware effectively with higher true positive rate and accuracy while maintaining a low false positive rate. Consequently, the AdaboostM1 (J48) classification algorithm based on information gain feature selection algorithm has the best detection result, which can achieve an accuracy of 99.8%, a true positive rate of 99.6% and a lowest false positive rate of 0.

Keywords: Android, permissions combination, API calls, machine learning.

Digital Object Identifier (DOI): doi.org/10.5281/zenodo.1126780

References:

[1] Chinese Internet Data Information Centre(199IT), http://www.199it.com/archives/390550.html
[2] Report of China Internet Network Information Center (CNNIC), The 37th China Internet Development Statistics(EB). https://www.cnnic.cn/ hlwfzyj/hlwxzbg/201601/P020160122469130059846.pdf
[3] NetQin (Never Quit), 2014 in the first quarter of the global mobile security message(EB).
[4] Zhou Y, Jiang X. Dissecting android malware: Characterization and evolution(C)//Security and Privacy (SP), 2012 IEEE Symposium on. IEEE, 2012: 95-109.
[5] Wei X, Gomez L, Neamtiu I, Faloutsos M. Permission evolution in the Android ecosystem. In: Proc. of the 28th Annual Computer Security Applications Conf. (ACSAC 2012). 2012. 31−40
[6] Saltzer JH. Protection and the control of information sharing in Multics. Communications of the ACM, 1974,17(7):388−402.
[7] Felt A P, Chin E, Hanna S, et al. Android permissions demystified(C)// Proceedings of the 18th ACM conference on Computer and communications security. ACM, 2011: 627-638.
[8] Au K W Y, Zhou Y F, Huang Z, et al. Pscout: analyzing the android permission specification (C)// Proceedings of the 2012 ACM conference on Computer and communications security. ACM,2012: 217-228.
[9] Enck W, Ongtang M, McDaniel P. On lightweight mobile phone application certification. In: Proc. of the 16th ACM Conf. on Computer and Communications Security (CCS 2009). 2009. 235−245
[10] Fuchs A P, Chaudhuri A, Foster J S. Scandroid: Automated security certification of android(J). 2009.
[11] Sanz B, Santos I, Laorden C, et al. MAMA: manifest analysis for malware detection in android(J). Cybernetics and Systems, 2013, 44(6-7): 469-488.
[12] Aafer Y, Du W, Yin H. DroidAPIMiner: Mining API-level features for robust malware detection in android(M)//Security and Privacy in Communication Networks. Springer International Publishing, 2013: 86-103.
[13] Yerima S Y, Sezer S, McWilliams G, et al. A new android malware detection approach using Bayesian classification(C)// Advanced Information Networking and Applications (AINA), 2013 IEEE 27th International Conference on. IEEE, 2013: 121-128.
[14] Wu D J, Mao C H, Wei T E, et al. Droidmat: Android malware detection through manifest and api calls tracing(C)// Information Security (Asia JCIS), 2012 Seventh Asia Joint Conference on. IEEE, 2012: 62-69.
[15] Zhou Y, Jiang X. Android malware genome project (EB/OL). IEEE,2012, (2014-02-27).