On Existence of Common Malicious System Call Codes in Android Malware Families
On Existence of Common Malicious System Call Codes in Android Malware Families
复制标题
DOI：
10.1109/tr.2020.2982537
复制
发表时间：
2021-03
影响因子：
5.9
通讯作者：
Roopak Surendran;Tony Thomas;S. Emmanuel
中科院分区：
文献类型：
--
作者：
Roopak Surendran;Tony Thomas;S. Emmanuel
Most of the existing Android malware detection mechanisms are based on machine learning algorithms. The problem with the machine learning approaches is the difficulty in finding the best features that uniquely characterize the malwares. Hence, in this article we explore the property that uniquely characterizes Android malware applications. Toward this, we model the system call sequence generated by a malware application as a stationary first-order ergodic Markov chain and prove the existence of typical patterns which contains the malicious system call code of the application. In our implementation, we find the occurrence of common malicious system call codes in the system call sequence of several malware families. Finally a malware detection mechanism is proposed based on the occurrence of malicious system call codes in the system call sequence of an application. We obtain a consistent accuracy of around 0.95 in balanced, slightly unbalanced, and highly unbalanced data sets. In the balanced and slightly unbalanced data sets we obtain greater precision than 0.90; whereas in the highly unbalanced data sets the precision obtained are slightly lower at 0.72.
