Semantics-Aware Android Malware Classification Using Weighted Contextual API Dependency Graphs

By Mu Zhang, Yue Duan, Heng Yin, Zhiruo Zhao. Conference on Computer and Communications Security, 2014

499 citations recorded by the source corpus.

The drastic increase of Android malware has led to a strong interest in developing methods to automate the malware analysis process. Existing automated Android malware detection and classification methods fall into two general categories: 1) signature-based and 2) machine learning-based. Signature-based approaches can be easily evaded by bytecode-level transformation attacks. Prior learning-based works extract features from application syntax, rather than program semantics, and are also subject to evasion. In this paper, we propose a novel semantic-based approach that classifies Android malware via dependency graphs. To battle transformation attacks, we extract a weighted contextual API dependency graph as program semantics to construct feature sets. To fight against malware variants and zero-day malware, we introduce graph similarity metrics to uncover homogeneous application behaviors while tolerating minor implementation differences. We implement a prototype system, DroidSIFT, in 23 thousand lines of Java code. We evaluate our system using 2200 malware samples and 13500 benign samples. Experiments show that our signature detection can correctly label 93\% of malware instances; our anomaly detector is capable of detecting zero-day malware with a low false negative rate (2\%) and an acceptable false positive rate (5.15\%) for a vetting purpose.

Subfields: Computer Networks and Communications, Software, Signal Processing

View Paper: https://www.semanticscholar.org/paper/0d7dea74b7344dcd4de965e9535e5cfa8630c94c

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Computer Networks and Communications

In Software

In Signal Processing

Citations in the corpus

Efficient Detection of Zero-day Android Malware Using Normalized Bernoulli Naive Bayes (2015, methodology): “Signature-based features are less reliable as they can be obfuscated by bytecode-level code transformation [6].”
Experimental Study with Real-world Data for Android App Security Analysis using Machine Learning (2015, methodology): “Several e↵orts explored this direction and proposed solutions [5, 6, 9, 21] in the recent past.”
Static analysis of android apps: A systematic literature review (2017, background): “[147], CloneCloud [34], DPartner [136], DroidAlarm [138], DroidChecker [140], DroidSIFT [60], eLens [66], EvoDroid [148], IFT [82], Julia [4], Lu et al.”
FeatureSmith: Automatically Engineering Features for Malware Detection by Mining the Security Literature (2016, background): “Subsequently, considerable efforts have been devoted to detecting Android malware, ranging from static and dynamic analysis [51, 54] to machine learning techniques [6, 8, 35].”
DroidDetector: Android Malware Characterization and Detection Using Deep Learning (2016, methodology): “[20, 34] and types of features presented in Refs.”
Contextual Weisfeiler-Lehman graph kernel for malware detection (2016, methodology): “As explained in [7] and [2], in the case of Android apps, one could determine whether a PRG node is reachable under user-aware or user-unaware context by examining its entry point nodes.”
Scalable Graph-based Bug Search for Firmware Images (2016, background): “Our empirical observations 1 Genius stands for Graph Encoding for Bug Search. may beneﬁt not only the bug search methods but also other related approaches [24,62,63].”
MADAM: Effective and Efficient Behavior-based Android Malware Detection and Prevention (2018, background): “Rootkits DroidSIFT [32] Static Offline (Server) 93% N.”
VUDDY: A Scalable Approach for Vulnerable Code Clone Discovery (2017, background): “Researchers have pointed out that function calls and shared APIs are typical causes of recurring vulnerabilities [12], [27], [33].”
A Multimodal Deep Learning Method for Android Malware Detection Using Various Features (2019, background): “DroidSIFT [5] classifies malware and benign applications by analyzing API dependency graphs of each application.”
Following Devil's Footprints: Cross-Platform Analysis of Potentially Harmful Libraries on Android and iOS (2016, background): “A lot of effort has been made to analyze and detect Android PHAs, most of which aims at detecting the code [37], [38], [39], [40], [41], [42], [43], [44], [45] for performing potentially harmful behaviors (e.g., stealing the user’s sensitive information), and protecting the Android system from…”
Android HIV: A Study of Repackaging Malware for Evading Machine-Learning Detection (2018, background): “[40] proposed a semantic-based approach to classify Android malware via dependency graphs.”
TESSERACT: Eliminating Experimental Bias in Malware Classification across Space and Time (2018, methodology): “The use of k-fold CV is widespread in malware classification research [8, 9, 22, 25, 28, 30, 33, 40, 41, 46]; while a commonmechanism to prevent overfitting [6], it is ill-suited for estimating the real-world performance of machine learning techniques with non-stationary data (e.”
*droid (2016, methodology): “Five tools are able to handle reﬂection involving string constants: DroidSafe [Gordon et al. 2015], Stowaway [Felt et al. 2011], FlowDroid [Arzt et al. 2014], DroidSift [Zhang et al. 2014a], and Scandal [Kim et al. 2012].”
MalDozer: Automatic framework for android malware detection using deep learning (2018, methodology): “Some methods (Zhang et al., 2014) (Fan et al., 2016), (Meng et al., 2016) employ semantics-aware features such as control e ﬂ ow graphs (Christodorescu and Jha, 2005), data dependency graphs (Fredrikson et al., 2010) and class dependence graphs (Deshotels et al., 2014).”
The Evolution of Android Malware and Android Analysis Techniques (2017, background): “DroidSIFT [Zhang et al. 2014], on the other hand, creates weighted, contextual, API dependency graphs to construct feature sets.”