DroidMat: Android Malware Detection through Manifest and API Calls Tracing
DroidMat: Android Malware Detection through Manifest and API Calls Tracing
复制标题
DOI：
10.1109/asiajcis.2012.18
复制
发表时间：
2012-08
期刊：
影响因子：
--
通讯作者：
Dong-Jie Wu;Ching-Hao Mao;Te-En Wei;Hahn-Ming Lee;Kuo-Ping Wu
中科院分区：
文献类型：
--
作者：
Dong-Jie Wu;Ching-Hao Mao;Te-En Wei;Hahn-Ming Lee;Kuo-Ping Wu
最近，Android恶意软件的威胁正在迅速传播，尤其是那些重新包装的Android恶意软件。尽管使用动态分析理解Android恶意软件可以提供全面的视图，但它仍会在环境部署和调查中的手动部署和手动努力中进行高昂的成本。在这项研究中，我们提出了一种基于静态功能的机制，以提供用于检测Android恶意软件的静态分析师范例。该机制考虑了静态信息，包括权限，组件的部署，通过意图传递和API呼吁以表征Android应用程序行为。为了识别Android恶意软件的不同意图，可以应用不同类型的聚类算法来增强恶意软件建模能力。此外，我们利用提出的机制并开发一个称为Droid Mat的系统。首先，机器人垫从每个应用程序的清单文件中提取信息（例如，请求的权限，意图消息，传递等），并将组件（活动，服务，接收器）提取为跟踪与权限相关的API调用的入口点。接下来，它应用了K-均值算法来增强恶意软件建模功能。群集的数量由低等级近似值的单数值分解（SVD）方法决定。最后，它使用KNN算法将应用程序分类为良性或恶意。实验结果表明，我们的方法的召回率比著名工具之一的召回率是Black Hat 2011上发表的Androguard之一，该工具的重点是Android恶意软件分析。此外，Droid Mat是有效的，因为将1738个应用程序视为Banign Apps或Android恶意软件，只需花费一半的时间即可。
Recently, the threat of Android malware is spreading rapidly, especially those repackaged Android malware. Although understanding Android malware using dynamic analysis can provide a comprehensive view, it is still subjected to high cost in environment deployment and manual efforts in investigation. In this study, we propose a static feature-based mechanism to provide a static analyst paradigm for detecting the Android malware. The mechanism considers the static information including permissions, deployment of components, Intent messages passing and API calls for characterizing the Android applications behavior. In order to recognize different intentions of Android malware, different kinds of clustering algorithms can be applied to enhance the malware modeling capability. Besides, we leverage the proposed mechanism and develop a system, called Droid Mat. First, the Droid Mat extracts the information (e.g., requested permissions, Intent messages passing, etc) from each application's manifest file, and regards components (Activity, Service, Receiver) as entry points drilling down for tracing API Calls related to permissions. Next, it applies K-means algorithm that enhances the malware modeling capability. The number of clusters are decided by Singular Value Decomposition (SVD) method on the low rank approximation. Finally, it uses kNN algorithm to classify the application as benign or malicious. The experiment result shows that the recall rate of our approach is better than one of well-known tool, Androguard, published in Black hat 2011, which focuses on Android malware analysis. In addition, Droid Mat is efficient since it takes only half of time than Androguard to predict 1738 apps as benign apps or Android malware.