TY - JOUR
T1 - DroidScribe: Classifying Android Malware Based on Runtime Behavior
AU - Dash, Santanu Kumar
AU - Suarez-Tangil, Guillermo
AU - Khan, Salahuddin
AU - Tam, Kimberly
AU - Ahmadi, Mansour
AU - Kinder, Johannes
AU - Cavallaro, Lorenzo
N1 - DBLP License: DBLP's bibliographic metadata records provided through http://dblp.org/ are distributed under a Creative Commons CC0 1.0 Universal Public Domain Dedication. Although the bibliographic metadata records are provided consistent with CC0 1.0 Dedication, the content described by the metadata records is not. Content may be subject to copyright, rights of privacy, rights of publicity and other restrictions.
PY - 2016/5
Y1 - 2016/5
N2 - The Android ecosystem has witnessed a surge in malware, which not only puts mobile devices at risk but also increases the burden on malware analysts assessing and categorizing threats. In this paper, we show how to use machine learning to automatically classify Android malware samples into families with high accuracy, while observing only their runtime behavior. We focus exclusively on dynamic analysis of runtime behavior to provide a clean point of comparison that is dual to static approaches. Specific challenges in the use of dynamic analysis on Android are the limited information gained from tracking low-level events and the imperfect coverage when testing apps, e.g., due to inactive command and control servers. We observe that on Android, pure system calls do not carry enough semantic content for classification and instead rely on lightweight virtual machine introspection to also reconstruct Android-level inter-process communication. To address the sparsity of data resulting from low coverage, we introduce a novel classification method that fuses Support Vector Machines with Conformal Prediction to generate high-accuracy prediction sets where the information is insufficient to pinpoint a single family.
AB - The Android ecosystem has witnessed a surge in malware, which not only puts mobile devices at risk but also increases the burden on malware analysts assessing and categorizing threats. In this paper, we show how to use machine learning to automatically classify Android malware samples into families with high accuracy, while observing only their runtime behavior. We focus exclusively on dynamic analysis of runtime behavior to provide a clean point of comparison that is dual to static approaches. Specific challenges in the use of dynamic analysis on Android are the limited information gained from tracking low-level events and the imperfect coverage when testing apps, e.g., due to inactive command and control servers. We observe that on Android, pure system calls do not carry enough semantic content for classification and instead rely on lightweight virtual machine introspection to also reconstruct Android-level inter-process communication. To address the sparsity of data resulting from low coverage, we introduce a novel classification method that fuses Support Vector Machines with Conformal Prediction to generate high-accuracy prediction sets where the information is insufficient to pinpoint a single family.
UR - https://pearl.plymouth.ac.uk/context/secam-research/article/2354/viewcontent/DroidScribe_20Classifying_20Android_20Malware_20Based_20on_20Runtime_20Behavior_20__20MoST2016.pdf
U2 - 10.1109/spw.2016.25
DO - 10.1109/spw.2016.25
M3 - Conference proceedings published in a journal
SP - 252
EP - 261
JO - 2016 IEEE Security and Privacy Workshops (SPW)
JF - 2016 IEEE Security and Privacy Workshops (SPW)
T2 - 2016 IEEE Security and Privacy Workshops (SPW)
Y2 - 22 May 2016 through 26 May 2016
ER -