Longitudinal Characterization and Sustainable Classification of Android Apps via SAD Profiles

by   Haipeng Cai, et al.

Machine learning-based malware detection dominates current security defense approaches for Android apps. However, due to the evolution of Android platforms and malware, existing such techniques are widely limited by their need for constant retraining that are costly, and reliance on new malware samples that may not be timely available. As a result, new and emerging malware slips through, as seen from the continued surging of malware in the wild. Thus, a more practical detector needs not only to be accurate but, more critically, to be able to sustain its capabilities over time without frequent retraining. In this paper, we study how Android apps evolve as a population over time, in terms of their behaviors related to accesses to sensitive information and operations. We first perform a longitudinal characterization of 6K benign and malicious apps developed across seven years, with focus on these sensitive accesses in app executions. Our study reveals, during the long evolution, a consistent, clear differentiation between malware and benign apps regarding such accesses, measured by relative statistics of relevant method calls. Following these findings, we developed DroidSpan, a novel classification system based on a new behavioral profile for Android apps. Through an extensive evaluation, we showed that DroidSpan can not only effectively detect malware but sustain high detection accuracy (93 F1 for five years). Through a dedicated study, we also showed its resiliency to sophisticated evasion schemes. By comparing to a state-of-the-art malware detector, we demonstrated the largely superior sustainability of our approach at reasonable costs.


page 1

page 2

page 3

page 4


A Preliminary Study On the Sustainability of Android Malware Detection

Machine learning-based malware detection dominates current security defe...

Android Malware Detection using Deep Learning on API Method Sequences

Android OS experiences a blazing popularity since the last few years. Th...

Fast Furious: Modelling Malware Detection as Evolving Data Streams

Malware is a major threat to computer systems and imposes many challenge...

MaMaDroid: Detecting Android Malware by Building Markov Chains of Behavioral Models (Extended Version)

As Android becomes increasingly popular, so does malware targeting it, t...

Metadata-based Malware Detection on Android using Machine Learning

In the digitized world, smartphones and their apps play an important rol...

Efficient Concept Drift Handling for Batch Android Malware Detection Models

The rapidly evolving nature of Android apps poses a significant challeng...

apk2vec: Semi-supervised multi-view representation learning for profiling Android applications

Building behavior profiles of Android applications (apps) with holistic,...

Please sign up or login with your details

Forgot password? Click here to reset