Mlifdect: Android Malware Detection Based on Parallel Machine Learning and Information Fusion

被引:22
作者
Wang, Xin [1 ]
Zhang, Dafang [1 ]
Su, Xin [2 ,3 ]
Li, Wenjia [4 ]
机构
[1] Hunan Univ, Coll Comp Sci & Elect Engn, Changsha, Hunan, Peoples R China
[2] Hunan Police Acad, Hunan Prov Key Lab Network Invest Technol, Changsha, Hunan, Peoples R China
[3] Hunan Police Acad, Key Lab Network Crime Invest Hunan Prov Coll, Changsha, Hunan, Peoples R China
[4] New York Inst Technol, Dept Comp Sci, New York, NY USA
基金
美国国家科学基金会;
关键词
Information fusion - Artificial intelligence - Static analysis - Android (operating system) - Learning systems - Formal logic;
D O I
10.1155/2017/6451260
中图分类号
TP [自动化技术、计算机技术];
学科分类号
0812 ;
摘要
In recent years, Android malware has continued to grow at an alarming rate. More recent malicious apps' employing highly sophisticated detection avoidance techniques makes the traditional machine learning based malware detection methods far less effective. More specifically, they cannot cope with various types of Android malware and have limitation in detection by utilizing a single classification algorithm. To address this limitation, we propose a novel approach in this paper that leverages parallel machine learning and information fusion techniques for better Android malware detection, which is named Mlifdect. To implement this approach, we first extract eight types of features from static analysis on Android apps and build two kinds of feature sets after feature selection. Then, a parallel machine learning detection model is developed for speeding up the process of classification. Finally, we investigate the probability analysis based and Dempster-Shafer theory based information fusion approaches which can effectively obtain the detection results. To validate our method, other state-of-the-art detection works are selected for comparison with real-world Android apps. The experimental results demonstrate that Mlifdect is capable of achieving higher detection accuracy as well as a remarkable run-time efficiency compared to the existing malware detection solutions.
引用
收藏
页数:14
相关论文
共 33 条
[1]  
Android, 2011, ANDROID BASEBRIDGE I
[2]  
[Anonymous], 2016, Internet security threat report
[3]  
[Anonymous], 2013, Proceedings of ACM Conference on Data and Application Security and Privacy (CODASPY)
[4]  
[Anonymous], 2012, Proceedings of ACM Symposium on Access Control Models and Technologies
[5]  
Arp D., 2014, P NDSS S 2014 FEBR 2
[6]  
Arzt S, 2014, ACM SIGPLAN NOTICES, V49, P259, DOI [10.1145/2594291.2594299, 10.1145/2666356.2594299]
[7]   UPPER AND LOWER PROBABILITIES INDUCED BY A MULTIVALUED MAPPING [J].
DEMPSTER, AP .
ANNALS OF MATHEMATICAL STATISTICS, 1967, 38 (02) :325-&
[8]   A static Android malicious code detection method based on multi-source fusion [J].
Du, Yao ;
Wang, Xiaoqing ;
Wang, Junfeng .
SECURITY AND COMMUNICATION NETWORKS, 2015, 8 (17) :3238-3246
[9]   TaintDroid: An Information-Flow Tracking System for Realtime Privacy Monitoring on Smartphones [J].
Enck, William ;
Gilbert, Peter ;
Han, Seungyeop ;
Tendulkar, Vasant ;
Chun, Byung-Gon ;
Cox, Landon P. ;
Jung, Jaeyeon ;
McDaniel, Patrick ;
Sheth, Anmol N. .
ACM TRANSACTIONS ON COMPUTER SYSTEMS, 2014, 32 (02)
[10]  
Ferreira Denzil, 2015, P 8 ACM C SEC PRIV W