MARVIN: Efficient and Comprehensive Mobile App Classification through Static and Dynamic Analysis
MARVIN: Efficient and Comprehensive Mobile App Classification through Static and Dynamic Analysis
复制标题
DOI：
10.1109/compsac.2015.103
复制
发表时间：
2015-07
期刊：
影响因子：
--
通讯作者：
Martina Lindorfer;M. Neugschwandtner;Christian Platzer
中科院分区：
文献类型：
--
作者：
Martina Lindorfer;M. Neugschwandtner;Christian Platzer
Android在智能手机操作系统市场占据主导地位，因此引起了恶意软件作者和研究人员的注意。尽管提出了相当多的恶意软件分析系统，但全面和实用的恶意软件分析解决方案很少，而且往往是短暂的。仅依赖静态分析的系统与日益流行的混淆和动态代码加载技术作斗争，而纯动态分析系统则容易出现分析逃避。我们介绍了MARVIN，这是一个结合了静态和动态分析的系统，它利用机器学习技术以恶意评分的形式评估与未知Android应用相关的风险。MARVIN执行静态和动态分析，都在设备外，通过丰富而全面的功能集来表示应用程序的属性和行为方面。在我们对迄今为止最大的Android恶意软件分类数据集（包括超过135,000个Android应用程序和15,000个恶意软件样本）的评估中，MARVIN正确分类了98.24%的恶意应用程序，误报率低于0.04%。我们进一步估计了维持检测性能所需的再训练间隔，并证明了我们的方法的长期实用性。
Android dominates the smartphone operating system market and consequently has attracted the attention of malware authors and researchers alike. Despite the considerable number of proposed malware analysis systems, comprehensive and practical malware analysis solutions are scarce and often short-lived. Systems relying on static analysis alone struggle with increasingly popular obfuscation and dynamic code loading techniques, while purely dynamic analysis systems are prone to analysis evasion. We present MARVIN, a system that combines static with dynamic analysis and which leverages machine learning techniques to assess the risk associated with unknown Android apps in the form of a malice score. MARVIN performs static and dynamic analysis, both off-device, to represent properties and behavioral aspects of an app through a rich and comprehensive feature set. In our evaluation on the largest Android malware classification data set to date, comprised of over 135,000 Android apps and 15,000 malware samples, MARVIN correctly classifies 98.24% of malicious apps with less than 0.04% false positives. We further estimate the necessary retraining interval to maintain the detection performance and demonstrate the long-term practicality of our approach.