MOCDroid: multi-objective evolutionary classifier for Android malware detection
MOCDroid: multi-objective evolutionary classifier for Android malware detection
复制标题
DOI：
10.1007/s00500-016-2283-y
复制
发表时间：
2017-12-01
期刊：
影响因子：
4.1
通讯作者：
Camacho, David
中科院分区：
文献类型：
--
作者：
Martin, Alejandro;Menendez, Hector D.;Camacho, David
恶意软件威胁正在增长，同时，隐藏策略被用来使其无法在当前的商业防病毒中发现。 Android是目标体系结构之一，由于在不同的日常设备中平台的广泛扩展，这些问题特别令人震惊。该检测与Android市场特别相关，以确保他们提供的所有软件都是干净的。但是，浮肿已被证明可以有效地逃避检测过程。在本文中，我们利用第三方呼吁绕过这些隐藏策略的效果，因为它们不能被混淆。我们将聚类和多目标优化结合在一起，以基于第三方呼叫组定义的特定行为生成分类器。优化者确保这些群体与恶意或良性行为有关，以清洁任何非歧视模式。该工具被称为Mocdroid，在测试中获得了95.15％的精度，其中1.69％的假阳性使用了从野外提取的真实应用程序，从而克服了Virustotal的所有商业防病毒发动机。
Malware threats are growing, while at the same time, concealment strategies are being used to make them undetectable for current commercial antivirus. Android is one of the target architectures where these problems are specially alarming due to the wide extension of the platform in different everyday devices. The detection is specially relevant for Android markets in order to ensure that all the software they offer is clean. However, obfuscation has proven to be effective at evading the detection process. In this paper, we leverage third-party calls to bypass the effects of these concealment strategies, since they cannot be obfuscated. We combine clustering and multi-objective optimisation to generate a classifier based on specific behaviours defined by third-party call groups. The optimiser ensures that these groups are related to malicious or benign behaviours cleaning any non-discriminative pattern. This tool, named MOCDroid, achieves an accuracy of 95.15 % in test with 1.69 % of false positives with real apps extracted from the wild, overcoming all commercial antivirus engines from VirusTotal.