PROJECT TITLE :

An efficient Android malware detection system based on method-level behavioral semantic analysis

ABSTRACT:

Every day, 12 000 new Android malware samples will be developed, according to a recent report. The efficient detection of developing malware is a pressing issue. Traditional methods for detecting developing malware rely on structured elements like permissions and sensitive application programming interface (API) calls, which lack high-level behavioral semantics. The approaches based on call graphs (CG) are effective in behavioral semantic analysis, but they have a significant time and space overhead, resulting in low detection efficiency. We present a novel Android malware detection method based on the method-level correlation relationship of abstracted API calls in this research. To begin, we separated each Android application's source code into independent function methods, keeping only the abstracted API calls in order to create a set of abstracted API calls transactions. The confidence of association rules between the abstracted API calls is then calculated, resulting in behavioral semantics to define an application. Finally, to develop the detection system, we use machine learning to distinguish the different behavioral patterns of malicious and benign apps. In terms of classification accuracy and detection efficiency, the results of our empirical study suggest that our system is competitive. Our system achieved 96 percent and 98 percent detection results in accuracy and F-measure for datasets Drebin (benign 5.9K and malware 5.6K) and AMD (benign 20.5K and malware 20.8K). On a dataset of 6.0K benign and 20.5K harmful samples spanning from 2010 to 2017, our method achieves higher accuracy while improving detection efficiency by 15 times when compared to the state-of-the-art approach in detecting developing malware dubbed MaMaDroid (2.9 s versus 45.7 s per sample).