Android Malicious Application Detection Research Articles

KFFPDet: Android malicious application detection system with assisted detection of adversarial samples

Machine learning methods are widely used in Android malware detection, but carefully scrambled adversarial samples can effectively evade detection. Adversarial defence methods such as retraining and ensemble learning have high training costs and significant errors. This paper proposes a novel Android malware detection system, KFFPDet, to detect adversarial samples. It can detect adversarial samples efficiently. Firstly, this paper uses K-Nearest Neighbor (KNN) as the primary detection algorithm. In addition, this paper proposes a three-stage adversarial sample detection method, which saves the detection cost and reduces the error through prior knowledge. In the first stage, the frequency difference between benign typical features and malicious typical features is used to filter adversarial samples. In the second stage, the feature continuous values of benign typical features are used for adversarial sample filtering. The third stage filters adversarial samples by detecting isolation permissions and application programming interface (API). Experiments on various benchmark datasets verify the detection effect of KFFPDet. KFFPDet achieves 96% accuracy of adversarial sample detection on the VirusShare dataset. Compared with other advanced methods, KFFPDet ’s adversarial sample detection accuracy is improved by 4.43% to 94.53%. The experimental results show that the proposed three-stage adversarial sample detection method is useful and will help design a more effective adversarial sample detection scheme.

Android Malware Detection Method Based on Permission Complement and API Calls

The dynamic code loading mechanism of the Android system allows an application to load executable files externally at runtime. This mechanism makes the development of applications more convenient, but it also brings security issues. Applications that hide malicious behavior in the external file by dynamic code loading are becoming a new challenge for Android malware detection. To overcome this challenge, based on dynamic code loading mechanisms, three types of threat models, i.e. Model I, Model II, and Model III are defined. For the Model I type malware, its malicious behavior occurs in DexCode, so the application programming interface (API) classes were used to characterize the behavior of the DexCode file. For the Model II type and Model III type malwares whose malicious behaviors occur in an external file, the permission complement is defined to characterize the behaviors of the external file. Based on permission complement and API calls, an Android malicious application detection method is proposed, of which feature sets are constructed by improving a feature selection method. Five datasets containing 15,581 samples are used to evaluate the performance of the proposed method. The experimental results show that our detection method achieves accuracy of 99.885% on general dataset, and performes the best on all evaluation metrics on all datasets in all comparison methods.

An Android Malicious Application Detection Method with Decision Mechanism in the Operating Environment of Blockchain

Recently, security policies and behaviour detection methods have been proposed to improve the security of blockchain by many researchers. However, these methods cannot discover the source of typical behaviours, such as the malicious applications in the blockchain environment. Android application is an important part of the blockchain operating environment, and machine learning-based Android malware application detection method is significant for blockchain user security. The way of constructing features in these methods determines the performance. The single-feature mechanism, training classifiers with one type of features, cannot detect the malicious applications effectively which exhibit the typical behaviours in various forms. The multifeatures fusion mechanism, constructing mixed features from multiple types of data sources, can cover more kinds of information. However, different types of data sources will interfere with each other in the mixed features constructed by this mechanism. That limits the performance of the model. In order to improve the detection performance of Android malicious applications in complex scenarios, we propose an Android malicious application detection method which includes parallel feature processing and decision mechanism. Our method uses RGB image visualization technology to construct three types of RGB image which are utilized to train different classifiers, respectively, and a decision mechanism is designed to fuse the outputs of subclassifiers through weight analysis. This approach simultaneously extracts different types of features, which preserve application information comprehensively. Different classifiers are trained by these features to guarantee independence of each feature and classifier. On this basis, a comprehensive analysis of many methods is performed on the Android malware dataset, and the results show that our method has better efficiency and adaptability than others.

SUIP: An Android malware detection method based on data flow features

Currently static detection is the most commonly used in Android malware detection. Among them, the extraction of various features is particularly important. In analysing the data flow features of applications, researchers usually use taint analysis method to extract. However, this method lack intermediate process features. So in this paper, we analyse the features of Android components to obtain application data transfer features for complementing the application data flow features and build a more complete combination of data flow features. Based on this, we propose a new Android malicious application detection method—SUIP. This method complements the missing features based on taint analysis, and combines the LightGBM algorithm to build a detection model. Finally, we use the sample set in Virusshare for experiments. Compared with the traditional static detection method of Android malicious code, the result shows that our detection method has a high detection accuracy of 98.50%.

MVIIDroid: A Multiple View Information Integration Approach for Android Malware Detection and Family Identification

With the rapid growth of Android applications, there is an urgent need for powerful Android malware detection technology nowadays. Existing classification models can be summarized with the following two steps-feature extraction and classification model learning. To further enhance the representation ability of existing classification models, this article presents an Android malicious application detection framework termed multiview information integration technology (MVIIDroid). To be specific, in our approach, we extract applications’ multiple components, transform them into embedding feature vectors and train a multiple Kernel learning model as the classifier. To illustrate the effectiveness of our model, we evaluate MVIIDroid on two Android malware datasets of 6820 malware and 6820 benign applications. Results show that we have superior classification performances when separating malware from benign applications. Moreover, we further evaluate MVIIDroid's ability to attribute malicious applications to their actual families. The experimental results well demonstrate the effectiveness of the proposed model.

基于改进朴素贝叶斯算法Android恶意应用的检测研究

随着智能手机的普及，Android手机上的应用也越来越广泛，随之而来的问题是Android安全问题越来越严峻。各种恶意应用也层出不穷，严重威胁到用户的信息安全。本文首先介绍了当前的手机安全状况，并对当前的Android恶意应用的检测技术进行了分析。由于Android应用越来越严峻的形势，本文提出了一种基于改进的朴素贝叶斯算法，并应用此算法设计了恶意应用检测系统。本文中的系统应用了逆向分析的方式来产生恶意应用分类器。然后，本文对实验结果进行了分析。 With the popularity of smart phones, Android mobile applications are becoming more widely and the attendant problem about the Android security issues becomes more critical. Malicious applications are endless. It is a serious threat to the user’s information security. This paper describes the current status of mobile security and the current Android malicious application detection techniques are analyzed. As the situation of Android applications becomes more and more serious, an improved Naive Bayes algorithm is proposed. The malicious application detection system is designed by using this algorithm. The system uses a reverse analysis method to produce the malicious application classifier. The experimental results are analyzed.