Benign Applications Research Articles

TriDroid: a triage and classification framework for fast detection of mobile threats in android markets

The Android platform is highly targeted by malware developers, which aim to infect the maximum number of mobile devices by uploading their malicious applications to different app markets. In order to keep a healthy Android ecosystem, app-markets check the maliciousness of newly submitted apps. These markets need to (a) correctly detect malicious app, and (b) speed up the detection process of the most likely dangerous applications among an overwhelming flow of submitted apps, to quickly mitigate their potential damages. To address these challenges, we propose TriDroid, a market-scale triage and classification system for Android apps. TriDroid prioritizes apps analysis according to their risk likelihood. To this end, we categorize the submitted apps as: botnet, general malware, and benign. TriDroid starts by performing a (1) Triage process, which applies a fast coarse-grained and less-accurate analysis on a continuous stream of the submitted apps to identify their corresponding queue in a three-class priority queuing system. Then, (2) the Classification process extracts fine-grained static features from the apps in the priority queue, and applies three-class machine learning classifiers to confirm with high accuracy the classification decisions of the triage process. In addition to the priority queuing model, we also propose a multi-server queuing model where the classification of each app category is run on a different server. Experiments on a dataset with more than 24K malicious and 3K benign applications show that the priority model offers a trade-off between waiting time and processing overhead, as it requires only one server compared to the multi-server model. Also it successfully prioritizes malicious apps analysis, which allows a short waiting time for dangerous applications compared to the FIFO policy.

Enhancement in Security of Android Devices Using Malware Prediction with Machine Learning

Due to large number of malicious applications in android devices, security of user data has become a serious issue. We need to detect and predict malware in android application to keep devices secure. SIGPID (Significant Permission Identification) approach extracts Significant Permission required in android application and uses this information to predict malware using supervised learning algorithm. DREBIN method performs broad static analysis and gathers required features from manifest file and application code. The features like network addresses, API calls, hardware components, permissions are mapped into joint vector space. Applying suitable machine learning algorithm to this vector space the system classifies application as malicious or benign application which results into improvement in the prediction accuracy. SIGPID aims to use less number of permissions to predict the malware presence whereas DREBIN aims at giving accurate predictions. We have used principles of these two algorithms to implemented malware detection system Safroid which aims to use less number of permissions and give accurate predictions.

Improving accuracy of HPC-based malware classification for embedded platforms using gradient descent optimization

Malware detection is still one of the difficult problems in computer security because of the daily occurrences of newer varieties of malware programs. There have been enormous efforts in developing a generalized solution to this critical security aspect, but a little has been done considering the security of resource constraint embedded devices. In this paper, we attempt to develop a lightweight malware detection tool explicitly designed for embedded platforms using micro-architectural side-channel information obtained through Hardware Performance Counters (HPCs) and high-level programs representing Operating System (OS) resources. The methodology uses statistical hypothesis testing, in the form of t-test, to develop a metric, called $$\lambda $$ , which indicates a conceptual boundary between the programs which are allowed to run on a given embedded platform, with the codes that are suspected as malwares. The metric is computed based on the observations obtained from carefully chosen features, which are tuples of high-level programs representing OS resources along with low-level HPCs. An ideal $$\lambda $$ -value for a malicious program is 1, as opposed to 0 for a benign application. However, in reality, the efficacy of $$\lambda $$ to classify a program as malware or benign largely depends on the proper assignment of weights to the tuples. We employ a gradient-descent-based learning mechanism to determine optimal choices for these weights. We present detailed experimental results on an embedded Linux running on an ARM processor which validates that the proposed lightweight side-channel-based learning mechanism improves the classification accuracy significantly compared to an ad-hoc selection of weights leading to significantly low false positives and false negatives in all our test cases.

Optimizing Android Malware Detection Via Ensemble Learning

<p>Android operating system has become very popular, with the highest market share, amongst all other mobile operating systems due to its open source nature and users friendliness. This has brought about an uncontrolled rise in malicious applications targeting the Android platform. Emerging trends of Android malware are employing highly sophisticated detection and analysis avoidance techniques such that the traditional signature-based detection methods have become less potent in their ability to detect new and unknown malware. Alternative approaches, such as the Machine learning techniques have taken the lead for timely zero-day anomaly detections. The study aimed at developing an optimized Android malware detection model using ensemble learning technique. Random Forest, Support Vector Machine, and k-Nearest Neighbours were used to develop three distinct base models and their predictive results were further combined using Majority Vote combination function to produce an ensemble model. Reverse engineering procedure was employed to extract static features from large repository of malware samples and benign applications. WEKA 3.8.2 data mining suite was used to perform all the learning experiments. The results showed that Random Forest had a true positive rate of 97.9%, a false positive rate of 1.9% and was able to correctly classify instances with 98%, making it a strong base model. The ensemble model had a true positive rate of 98.1%, false positive rate of 1.8% and was able to correctly classify instances with 98.16%. The finding shows that, although the base learners had good detection results, the ensemble learner produced a better optimized detection model compared with the performances of those of the base learners.</p>

A Lightweight Android Malware Classifier Using Novel Feature Selection Methods

Smartphones and mobile tablets play significant roles in daily life and have led to an increase in the number of users of this technology. The rising number of mobile device end-users has resulted in the generation of malware by hackers. Thus, mobile devices are becoming vulnerable to malware. Machine learning plays an important role in the detection of mobile malware applications. In this study, we focus on static analysis for Android malware detection. The ultimate goal of this research is to find out the symmetric features across the malware Android application to easily detect them. Many state-of-the-art methods focus on extracting asymmetric patterns of the category of features, e.g., application permissions to distinguish the malware application from the benign application. In this work, we propose a compromise by considering different types of static features and select the most important features that affect the detection process. These features represent the symmetric pattern to be used for the classification task. Inspired by TF-IDF, we propose a novel method of feature selection. Moreover, we propose a new method for merging the Android application URLs into a single feature called the URL_score. Several linear machine learning classifiers are utilized to evaluate the proposed method. The proposed methods significantly reduce the feature space, i.e., the symmetric pattern, of the Android application dataset and the memory size of the final model. In addition, the proposed model achieves the highest reported accuracy for the Drebin dataset to date. Based on the evaluation results, the linear support vector machine achieves an accuracy of 99%.

AppPerm Analyzer: Malware Detection System Based on Android Permissions and Permission Groups

Besides the applications aimed at increasing the efficiency of the Android mobile devices, also many malicious applications, millions of Android malware according to various security company reports, are being developed and uploaded into the application stores. In order to detect those applications, a malicious Android application detection system based on permission and permission groups namely, AppPerm Analyzer has been developed. The AppPerm Analyzer software extracts the manifest and code permissions of analyzed applications, creates duple and triple permission groups from them, calculates risk scores of these permissions and permission groups according to their usage rates in malicious and benign applications and calculates the total risk score of the analyzed application. After training the software with 7776 applications in total, it is tested with 1664 benign and 1664 malicious applications. In the tests, AppPerm Analyzer detected malicious applications with an accuracy of 96.19% at most. At this point, sensitivity (true-positive ratio) is 95.50% and specificity (true-negative ratio) is 96.88%. If a false-positive ratio up to 10% is accepted, the sensitivity increases to 99.04%.

End-to-end malware detection for android IoT devices using deep learning

The Internet of Things (IoT) has grown rapidly in recent years and has become one of the most active areas in the global market. As an open source platform with a large number of users, Android has become the driving force behind the rapid development of the IoT, also attracted malware attacks. Considering the explosive growth of Android malware in recent years, there is an urgent need to propose efficient methods for Android malware detection. Although the existing Android malware detection methods based on machine learning has achieved encouraging performance, most of these methods require a lot of time and effort from the malware analysts to build dynamic or static features, so these methods are difficult to apply in practice. Therefore, end-to-end malware detection methods without human expert intervention are required. This paper proposes two end-to-end Android malware detection methods based on deep learning. Compared with the existing detection methods, the proposed methods have the advantage of their end-to-end learning process. Our proposed methods resample the raw bytecodes of the classes.dex files of Android applications as input to deep learning models. These models are trained and evaluated in a dataset containing 8K benign applications and 8K malicious applications. Experiments show that the proposed methods can achieve 93.4% and 95.8% detection accuracy respectively. Compared with the existing methods, our proposed methods are not limited by input filesize, no manual feature engineering, low resource consumption, so they are more suitable for application on Android IoT devices.

Android Malware Detection Using Fine-Grained Features

Nowadays, Android applications declare as many permissions as possible to provide more function for the users, which also poses severe security threat to them. Although many Android malware detection methods based on permissions have been developed, they are ineffective when malicious applications declare few dangerous permissions or when the dangerous permissions declared by malicious applications are similar with those declared by benign applications. This limitation is attributed to the use of too few information for classification. We propose a new method named fine-grained dangerous permission (FDP) method for detecting Android malicious applications, which gathers features that better represent the difference between malicious applications and benign applications. Among these features, the fine-grained feature of dangerous permissions applied in components is proposed for the first time. We evaluate 1700 benign applications and 1600 malicious applications and demonstrate that FDP achieves a TP rate of 94.5%. Furthermore, compared with other related detection approaches, FDP can detect more malware families and only requires 15.205 s to analyze one application on average, which demonstrates its applicability for practical implementation.

Synthetic Minority Oversampling Technique for Optimizing Classification Tasks in Botnet and Intrusion-Detection-System Datasets

Presently, security is a hot research topic due to the impact in daily information infrastructure. Machine-learning solutions have been improving classical detection practices, but detection tasks employ irregular amounts of data since the number of instances that represent one or several malicious samples can significantly vary. In highly unbalanced data, classification models regularly have high precision with respect to the majority class, while minority classes are considered noise due to the lack of information that they provide. Well-known datasets used for malware-based analyses like botnet attacks and Intrusion Detection Systems (IDS) mainly comprise logs, records, or network-traffic captures that do not provide an ideal source of evidence as a result of obtaining raw data. As an example, the numbers of abnormal and constant connections generated by either botnets or intruders within a network are considerably smaller than those from benign applications. In most cases, inadequate dataset design may lead to the downgrade of a learning algorithm, resulting in overfitting and poor classification rates. To address these problems, we propose a resampling method, the Synthetic Minority Oversampling Technique (SMOTE) with a grid-search algorithm optimization procedure. This work demonstrates classification-result improvements for botnet and IDS datasets by merging synthetically generated balanced data and tuning different supervised-learning algorithms.

Detecting Ransomware Using Process Behavior Analysis

Ransomware attacks are one of the biggest and attractive threats in cyber security today. Anti-virus software’s are often inefficient against zero-day malware and ransomware attacks, important network infections could result in a large amount of data loss. Such attacks are also becoming more dynamic and able to change their signatures – hence creating an arms race situation. This study investigates the relationship between a process behavior and its nature, in order to determine whether it is ransomware or not. The paper aim is to see if using this method will help the evading malicious software’s and use as a self-defense mechanism using machine learning that emulates the human immune system. The analysis was conducted on 7 ransomware, 41 benign software, and 34 malware samples. The results show that we are able to distinguish between ransomware and benign applications, with a low false-positive and false-negative rate.

Android Malware Detection based on Vulnerable Feature Aggregation

Abstract Android has paved the way for the smartphone revolution. With the ever-growing advancements in technology, there is an inherent increase in the user reliance upon mobile technologies and third-party applications for communication, banking, and commerce. Needless to say, this is accompanied by steady growth in the number of attack surfaces, giving rise to new and highly advanced malicious software. Traditional malware detection approaches have revolved around pattern-based detection, which can easily be deterred using zero-day attacks. In this paper, we present a novel feature-engineering technique for android malware detection using Machine Learning. We perform static analysis to map each Application Programming Interface call to certain features, which is later aggregated to find the frequency of occurrence per feature. We empirically evaluate our approach and its robustness on 972 obfuscated android applications and 1100 benign applications and achieve an ROC-AUC score of 98.87%. We also demonstrate the scalability of our model by reducing the feature set by 75.9% and achieving a comparable ROC-AUC score of 95.67%.

Hesitant fuzzy linguistic TOPSIS method for the electric vehicles’ charging stations location selection problem and an application for Istanbul

The prevalence of environmental studies in the academy has increased in recent years, depending on the adverse effects of global warming on natural resources. Besides various environmentally benign applications, one of the most important instruments on eliminating the negative environmental effects of an increasing population is electric vehicles. There are various topics within the concept of electric vehicles, including the determination of electric vehicle type, routing, network design, and so on. However, in this study, determining the locations of electric charging stations is the main focus. The problem is handled as a multi-criteria decision-making problem with the consideration of the uncertainties in the decision-making environment. Specifically, the judgments of decision-makers play a critical role in the success of decisions, but for a decision-maker, it is usually difficult to express his/her preferences by using only one linguistic term due to the structure of some criteria type. Hence, with the proposed methodology, in this study, criteria are firstly classified as fuzzy and crisp according to their objective or subjective characteristics. Afterwards, besides the utilization of classic techniques for crisp type criteria, probabilistic linguistic terms sets are utilized for fuzzy type criteria with an extended version of TOPSIS. The proposed methodology is used for the comparison of 39 alternative electric charging locations in Istanbul, which is one of the most crowded cities in Europe.

On Fingerprinting of Public Malware Analysis Services

Abstract Automatic public malware analysis services (PMAS, e.g. VirusTotal, Jotti or ClamAV, to name a few) provide controlled, isolated and virtual environments to analyse malicious software (malware) samples. Unfortunately, malware is currently incorporating techniques to recognize execution onto a virtual or sandbox environment; when an analysis environment is detected, malware behaves as a benign application or even shows no activity. In this work, we present an empirical study and characterization of automatic PMAS, considering 26 different services. We also show a set of features that allow to easily fingerprint these services as analysis environments; the lower the unlikeability of these features, the easier for us (and thus for malware) to fingerprint the analysis service they belong to. Finally, we propose a method for these analysis services to counter or at least mitigate our proposal.

Palladium Nanocatalysts Encapsulated on Porous Silica @ Magnetic Carbon‐Coated Cobalt Nanoparticles for Sustainable Hydrogenation of Nitroarenes, Alkenes and Alkynes.

AbstractPalladium nanoparticles were impregnated on porous silica shell carbon‐coated cobalt nanoparticles, resulting in a magnetically retrievable material that was evaluated in the catalytic hydrogenation of nitroarenes, alkenes and alkynes. The prepared material was characterized by HR‐XRD, HR‐TEM, elemental mapping EDX, ICP‐OES and XPS analyses, revealing highly dispersed palladium nanoparticles within the porous platform that could account for the high activity observed. Mild reaction conditions, easy retrievability of the catalyst with the aid of an external magnet, recycling in four runs with a total leaching of 19 ppm (1.2 % of the initially employed Pd amount), and high stability makes this material attractive for sustainable and environmentally benign applications.

Reducing Security Risks of Suspicious Data and Codes Through a Novel Dynamic Defense Model

A remarkable characteristic of the modern operating system is open, which means that we can download data or execute codes from any Internet sources whether they are trusted or not. Therefore, there is a contradict situation when we want to use these data or codes as well as keep the system secured. Despite decades of studies and experiences on this problem, it is still assumed as a great challenge. This paper presents a novel dynamic defense model (DDM) to reduce security risks brought by these suspicious data or codes for the open operating systems. DDM is a high-level security defense abstraction with four key components: dynamic label marking, dynamic label tracking, dynamic label modulating, and run-time controlling. With these components, DDM achieves the full, dynamic, and real-time security protection in the whole life cycle of the operating system. We also practically implemented a prototype system named DDDroid on Android. We constructed a mixed experimental dataset with 30 malware samples and 970 benign applications to test the defense effects of DDDroid. DDDroid detects 97% of the malware samples that have malicious actions and blocks these actions with a negligible false positive on legal actions. We also demonstrated that DDDroid is an effective system, which prevents sensitive data from being leaked by suspicious applications deliberately or by users unintentionally through some sample experiments. What is more, with extensive evaluations, DDDroid is proved to be a system with low-performance overhead and limited memory consumption.

AdDroid: Rule-Based Machine Learning Framework for Android Malware Analysis

Recent years have witnessed huge growth in Android malware development. Colossal reliance on Android applications for day to day working and their massive development dictates for an automated mechanism to distinguish malicious applications from benign ones. A significant amount of research has been devoted to analyzing and mitigating this growing problem; however, attackers are using more complicated techniques to evade detection. This paper proposes a framework, AdDroid; for analyzing and detecting malicious behaviour in Android applications based on various combinations of artefacts called Rules. The artefacts represent actions of an Android application such as connecting to the Internet, uploading a file to a remote server or installing another package on the device etc. AdDroid employs an ensemble-based machine learning technique where Adaboost is combined with traditional classifiers in order to train a model founded on static analysis of Android applications that is capable of recognizing malicious applications. Feature selection and extraction techniques are used to get the most distinguishing Rules. The proposed model is created using a dataset comprising 1420 Android applications with 910 malicious and 510 benign applications. Our proposed system achieved an accuracy of 99.11% with 98.61% True Positive (TP) and 99.33% True Negative (TN) rate. The high TP and TN rates reflect the efficacy on both major and minor class. Since the proposed solution has exceptionally low computational complexity, therefore, making it possible to analyze applications in real-time.

A Comparative Preliminary Analysis of Selected Fruit Peel Waste Fermented Solutions: Impact of Shorter Fermentation in Biosurfactant Production

Introduction: Fruit waste mediated biosurfactant (BS) embraces the considerable attention in this green chemistry era to provide an environment benign application. In this study, the impact of a shorter fermentation on the BS production was studied by employing selected fruit peels as a cheaper substrate. Materials and Methods: The avocado, banana, lemon and pineapple fruit peel wastes were collected and used for fermentation along with water and molasses. The setup was treated separately with and without yeast in order to study its effects in fermentation. Results: The effect of yeast as a catalyst in a shorter fermentation period has been found to be negative. The emulsification index (E24) values indicated that the fermented solutions of banana and lemon have better emulsification activity compared to the other fruit waste fermented solutions produced in this study. Foam formation, color removal, and seed germination values suggested that the BS production was very minimum and alcohol was found to be dominant in all the fermented solutions. Conclusions: It can be concluded that the fermentation periods of 30 days are not sufficient to produce the BS in higher quality and quantities by using fruit peels. This is while the fruit peels used in this study are capable to produce and can be used as renewable, eco-friendly, and economic substrates for producing BS in an appropriate fermentation period. Still, further studies are needed to elucidate the complete chemical reaction and the components involved in the experimental setup tested in this study.

Android Malware Detection Using Complex-Flows

This paper proposes a new technique to detect mobile malware based on information flow analysis. Our approach examines the structure of information flows to identify patterns of behavior present in them and which flows are related, those that share partial computation paths. We call such flows Complex-Flows, as their structure, patterns, and relations accurately capture the complex behavior exhibited by both recent malware and benign applications. N-gram analysis is used to identify unique and common behavioral patterns present in Complex-Flows. The N-gram analysis is performed on sequences of API calls that occur along Complex-Flows’ control flow paths. We show the precision of our technique by applying it to four different data sets totaling 8,598 apps. These data sets consist of both recent and older generation benign and malicious apps to demonstrate the effectiveness of our approach across different generations of apps.

Towards Privacy Risk Analysis in Android Applications Using Machine Learning Approaches

Android-based devices easily fall prey to an attack due to its free availability in the android market. These Android applications are not certified by the legitimate organization. If the user cannot distinguish between the set of permissions requested by an application and its risk, then an attacker can easily exploit the permissions to propagate malware. In this article, the authors present an approach for privacy risk analysis in Android applications using machine learning. The proposed approach can analyse and identify the malware application permissions. Here, the authors achieved high accuracy and improved F-measure through analyzing the proposed method on the M0Droid dataset and completed testing on an extensive test set with malware from the Androzoo dataset and benign applications from the Drebin dataset.

Research on Data Mining of Permission-Induced Risk for Android IoT Devices

With the growing era of the Internet of Things (IoT), more and more devices are connecting with the Internet using android applications to provide various services. The IoT devices are used for sensing, controlling and monitoring of different processes. Most of IoT devices use Android applications for communication and data exchange. Therefore, a secure Android permission privileged mechanism is required to increase the security of apps. According to a recent study, a malicious Android application is developed almost every 10 s. To resist this serious malware campaign, we need effective malware detection approaches to identify malware applications effectively and efficiently. Most of the studies focused on detecting malware based on static and dynamic analysis of the applications. However, to analyse the risky permission at runtime is a challenging task. In this study, first, we proposed a novel approach to distinguish between malware and benign applications based on permission ranking, similarity-based permission feature selection, and association rule for permission mining. Secondly, the proposed methodology also includes the enhancement of the random forest algorithm to improve the accuracy for malware detection. The experimental outcomes demonstrate high proficiency of the accuracy for malware detection, which is pivotal for android apps aiming for secure data exchange between IoT devices.