Quick and Accurate Android Malware Detection Based on Sensitive APIs

Abstract

With the rapid development of Android applications in recent years, the Android applications' security has more and more attention paid to it. The Android malware detection can be divided into two types: behavior-based malware detection and code-based malware detection. In this paper, we present a behavior-based quick and accurate Android malicious detection scheme based on sensitive API calls. In the training process, the API calls of various applications are extracted as a large eigenvector through the reverse analysis. Then we employ the mutual information to measure the correlation between specific API calls and malware, and generate a set of sensitive API calls. In the scanning process, an ensemble learning model based on decision tree classifier and kNN classifier is used to detect unknown APKs quickly and accurately. We construct massive experiments, including 516 benign applications and 528 malicious applications. The experimental results demonstrate that the accuracy of our scheme can be up to 92%, and the precision is up to 93%.