Skip to main content
Top

2018 | OriginalPaper | Chapter

MulAV: Multilevel and Explainable Detection of Android Malware with Data Fusion

Authors : Qun Li, Zhenxiang Chen, Qiben Yan, Shanshan Wang, Kun Ma, Yuliang Shi, Lizhen Cui

Published in: Algorithms and Architectures for Parallel Processing

Publisher: Springer International Publishing

Activate our intelligent search to find suitable subject content or patents.

search-config
loading …

Abstract

With the popularization of smartphones, the number of mobile applications has grown substantially. However, many malware are emerging and thus pose a serious threat to the user’s mobile phones. Malware detection has become a public concern that requires urgent resolution. In this paper, we propose MulAV, a multilevel and explainable detection method with data fusion. Our method obtain information from multiple levels (the APP source code, network traffic, and geospatial information) and combine it with machine learning method to train a model which can identify mobile malware with high accuracy and few false alarms. Experimental result shows that MulAV outperforms other anti-virus scanners and methods and achieves a detection rate of 97.8% with 0.4% false alarms. Furthermore, for the benefit of users, MulAV displays the explanation for each detection, thus revealing relevant properties of the detected malware.

Dont have a licence yet? Then find out more about our products and how to get one now:

Springer Professional "Wirtschaft+Technik"

Online-Abonnement

Mit Springer Professional "Wirtschaft+Technik" erhalten Sie Zugriff auf:

  • über 102.000 Bücher
  • über 537 Zeitschriften

aus folgenden Fachgebieten:

  • Automobil + Motoren
  • Bauwesen + Immobilien
  • Business IT + Informatik
  • Elektrotechnik + Elektronik
  • Energie + Nachhaltigkeit
  • Finance + Banking
  • Management + Führung
  • Marketing + Vertrieb
  • Maschinenbau + Werkstoffe
  • Versicherung + Risiko

Jetzt Wissensvorsprung sichern!

Springer Professional "Technik"

Online-Abonnement

Mit Springer Professional "Technik" erhalten Sie Zugriff auf:

  • über 67.000 Bücher
  • über 390 Zeitschriften

aus folgenden Fachgebieten:

  • Automobil + Motoren
  • Bauwesen + Immobilien
  • Business IT + Informatik
  • Elektrotechnik + Elektronik
  • Energie + Nachhaltigkeit
  • Maschinenbau + Werkstoffe




 

Jetzt Wissensvorsprung sichern!

Springer Professional "Wirtschaft"

Online-Abonnement

Mit Springer Professional "Wirtschaft" erhalten Sie Zugriff auf:

  • über 67.000 Bücher
  • über 340 Zeitschriften

aus folgenden Fachgebieten:

  • Bauwesen + Immobilien
  • Business IT + Informatik
  • Finance + Banking
  • Management + Führung
  • Marketing + Vertrieb
  • Versicherung + Risiko




Jetzt Wissensvorsprung sichern!

Literature
6.
go back to reference Arp, D., Spreitzenbarth, M., Hubner, M., Gascon, H., Rieck, K., Siemens, C.: DREBIN: effective and explainable detection of android malware in your pocket. In: Ndss, vol. 14, pp. 23–26 (2014) Arp, D., Spreitzenbarth, M., Hubner, M., Gascon, H., Rieck, K., Siemens, C.: DREBIN: effective and explainable detection of android malware in your pocket. In: Ndss, vol. 14, pp. 23–26 (2014)
7.
go back to reference Cao, D., et al.: Droidcollector: a high performance framework for high quality android traffic collection. In: 2016 IEEE Trustcom/BigDataSE/ISPA, pp. 1753–1758. IEEE (2016) Cao, D., et al.: Droidcollector: a high performance framework for high quality android traffic collection. In: 2016 IEEE Trustcom/BigDataSE/ISPA, pp. 1753–1758. IEEE (2016)
8.
go back to reference Chakraborty, T., Pierazzi, F., Subrahmanian, V.: EC2: ensemble clustering and classification for predicting android malware families. IEEE Trans. Dependable Secur. Comput., 1 (2017) Chakraborty, T., Pierazzi, F., Subrahmanian, V.: EC2: ensemble clustering and classification for predicting android malware families. IEEE Trans. Dependable Secur. Comput., 1 (2017)
9.
go back to reference Enck, W., et al.: TaintDroid: an information-flow tracking system for realtime privacy monitoring on smartphones. ACM Trans. Comput. Syst. (TOCS) 32(2), 5 (2014)CrossRef Enck, W., et al.: TaintDroid: an information-flow tracking system for realtime privacy monitoring on smartphones. ACM Trans. Comput. Syst. (TOCS) 32(2), 5 (2014)CrossRef
10.
11.
go back to reference Narudin, F.A., Feizollah, A., Anuar, N.B., Gani, A.: Evaluation of machine learning classifiers for mobile malware detection. Soft Comput. 20(1), 343–357 (2016)CrossRef Narudin, F.A., Feizollah, A., Anuar, N.B., Gani, A.: Evaluation of machine learning classifiers for mobile malware detection. Soft Comput. 20(1), 343–357 (2016)CrossRef
12.
go back to reference Octeau, D., et al.: Combining static analysis with probabilistic models to enable market-scale android inter-component analysis. In: ACM SIGPLAN Notices, vol. 51, pp. 469–484. ACM (2016)CrossRef Octeau, D., et al.: Combining static analysis with probabilistic models to enable market-scale android inter-component analysis. In: ACM SIGPLAN Notices, vol. 51, pp. 469–484. ACM (2016)CrossRef
13.
go back to reference Saracino, A., Sgandurra, D., Dini, G., Martinelli, F.: MADAM: effective and efficient behavior-based android malware detection and prevention. IEEE Trans. Dependable Secur. Comput. 15, 83–97 (2016)CrossRef Saracino, A., Sgandurra, D., Dini, G., Martinelli, F.: MADAM: effective and efficient behavior-based android malware detection and prevention. IEEE Trans. Dependable Secur. Comput. 15, 83–97 (2016)CrossRef
14.
go back to reference Spreitzenbarth, M., Schreck, T., Echtler, F., Arp, D., Hoffmann, J.: Mobile-Sandbox: combining static and dynamic analysis with machine-learning techniques. Int. J. Inf. Secur. 14(2), 141–153 (2015)CrossRef Spreitzenbarth, M., Schreck, T., Echtler, F., Arp, D., Hoffmann, J.: Mobile-Sandbox: combining static and dynamic analysis with machine-learning techniques. Int. J. Inf. Secur. 14(2), 141–153 (2015)CrossRef
15.
go back to reference Suarez-Tangil, G., Dash, S.K., Ahmadi, M., Kinder, J., Giacinto, G., Cavallaro, L.: DroidSieve: fast and accurate classification of obfuscated android malware. In: Proceedings of the Seventh ACM on Conference on Data and Application Security and Privacy, pp. 309–320. ACM (2017) Suarez-Tangil, G., Dash, S.K., Ahmadi, M., Kinder, J., Giacinto, G., Cavallaro, L.: DroidSieve: fast and accurate classification of obfuscated android malware. In: Proceedings of the Seventh ACM on Conference on Data and Application Security and Privacy, pp. 309–320. ACM (2017)
16.
go back to reference Tong, F., Yan, Z.: A hybrid approach of mobile malware detection in android. J. Parallel Distrib. Comput. 103, 22–31 (2017)CrossRef Tong, F., Yan, Z.: A hybrid approach of mobile malware detection in android. J. Parallel Distrib. Comput. 103, 22–31 (2017)CrossRef
17.
go back to reference Wang, S., et al.: TrafficAV: an effective and explainable detection of mobile malware behavior using network traffic. In: 2016 IEEE/ACM 24th International Symposium on Quality of Service (IWQoS), pp. 1–6. IEEE (2016) Wang, S., et al.: TrafficAV: an effective and explainable detection of mobile malware behavior using network traffic. In: 2016 IEEE/ACM 24th International Symposium on Quality of Service (IWQoS), pp. 1–6. IEEE (2016)
18.
go back to reference Wong, M.Y., Lie, D.: IntelliDroid: a targeted input generator for the dynamic analysis of android malware. In: NDSS, vol. 16, pp. 21–24 (2016) Wong, M.Y., Lie, D.: IntelliDroid: a targeted input generator for the dynamic analysis of android malware. In: NDSS, vol. 16, pp. 21–24 (2016)
19.
go back to reference Zhang, J.: Research of Android application security. Ph.D. thesis, Beijing University of Posts and Telecommunications (2013) Zhang, J.: Research of Android application security. Ph.D. thesis, Beijing University of Posts and Telecommunications (2013)
Metadata
Title
MulAV: Multilevel and Explainable Detection of Android Malware with Data Fusion
Authors
Qun Li
Zhenxiang Chen
Qiben Yan
Shanshan Wang
Kun Ma
Yuliang Shi
Lizhen Cui
Copyright Year
2018
DOI
https://doi.org/10.1007/978-3-030-05063-4_14

Premium Partner