MADAM: Effective and Efficient Behavior-based Android Malware Detection and Prevention
MADAM: Effective and Efficient Behavior-based Android Malware Detection and Prevention
复制标题
DOI：
10.1109/tdsc.2016.2536605
复制
发表时间：
2018-01-01
影响因子：
7.3
通讯作者：
Martinelli, Fabio
中科院分区：
文献类型：
--
作者：
Saracino, Andrea;Sgandurra, Daniele;Martinelli, Fabio
Android用户不断受到越来越多的恶意应用程序（应用程序）的威胁，这些应用程序通常被称为恶意软件。恶意软件对用户隐私、金钱、设备和文件完整性构成严重威胁。在本文中，我们注意到，通过研究它们的行为，我们可以将恶意软件分类为少量的行为类，每个行为类都执行一组有限的错误行为，这些行为是它们的特征。这些不当行为可以通过监控属于不同Android级别的功能来定义。在本文中，我们提出了MADAM，一种新的基于主机的恶意软件检测系统的Android设备，同时分析和关联功能在四个级别：内核，应用程序，用户和包，检测和阻止恶意行为。MADAM是专门设计来考虑这些行为的，这些行为是几乎每一个真实的恶意软件的特征，可以在野外找到。MADAM通过利用两个并行分类器和一个基于行为签名的检测器的合作，检测并有效阻止了超过96%的恶意应用程序，这些应用程序来自三个大型数据集，约有2，800个应用程序。广泛的实验，其中还包括对9，804个真正应用程序的测试平台的分析，已经进行了大量的实验，以显示低误报率，可忽略的性能开销和有限的电池消耗。
Android users are constantly threatened by an increasing number of malicious applications (apps), generically called malware. Malware constitutes a serious threat to user privacy, money, device and file integrity. In this paper we note that, by studying their actions, we can classify malware into a small number of behavioral classes, each of which performs a limited set of misbehaviors that characterize them. These misbehaviors can be defined by monitoring features belonging to different Android levels. In this paper we present MADAM, a novel host-based malware detection system for Android devices which simultaneously analyzes and correlates features at four levels: kernel, application, user and package, to detect and stop malicious behaviors. MADAM has been specifically designed to take into account those behaviors that are characteristics of almost every real malware which can be found in the wild. MADAM detects and effectively blocks more than 96 percent of malicious apps, which come from three large datasets with about 2,800 apps, by exploiting the cooperation of two parallel classifiers and a behavioral signature-based detector. Extensive experiments, which also includes the analysis of a testbed of 9,804 genuine apps, have been conducted to show the low false alarm rate, the negligible performance overhead and limited battery consumption.