Significant Permission Identification for Machine-Learning-Based Android Malware Detection

By Jin Li, Lichao Sun, Qiben Yan, Zhiqiang Li, W. Srisa-an, Heng Ye. IEEE Transactions on Industrial Informatics, 2018

504 citations recorded by the source corpus.

The alarming growth rate of malicious apps has become a serious issue that sets back the prosperous mobile ecosystem. A recent report indicates that a new malicious app for Android is introduced every 10 s. To combat this serious malware campaign, we need a scalable malware detection approach that can effectively and efficiently identify malware apps. Numerous malware detection tools have been developed, including system-level and network-level approaches. However, scaling the detection for a large bundle of apps remains a challenging task. In this paper, we introduce Significant Permission IDentification (SigPID), a malware detection system based on permission usage analysis to cope with the rapid increase in the number of Android malware. Instead of extracting and analyzing all Android permissions, we develop three levels of pruning by mining the permission data to identify the most significant permissions that can be effective in distinguishing between benign and malicious apps. SigPID then utilizes machine-learning-based classification methods to classify different families of malware and benign apps. Our evaluation finds that only 22 permissions are significant. We then compare the performance of our approach, using only 22 permissions, against a baseline approach that analyzes all permissions. The results indicate that when a support vector machine is used as the classifier, we can achieve over 90% of precision, recall, accuracy, and F-measure, which are about the same as those produced by the baseline approach while incurring the analysis times that are 4–32 times less than those of using all permissions. Compared against other state-of-the-art approaches, SigPID is more effective by detecting 93.62% of malware in the dataset and 91.4% unknown/new malware samples.

Subfields: Computer Networks and Communications, Software, Signal Processing

View Paper: https://www.semanticscholar.org/paper/220bb101e07c08bb154721b2376a8b8993c45db3

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Computer Networks and Communications

  1. Brij Bhooshan Gupta
  2. Ömer Aslan
  3. Refik Samet

In Software

  1. Ömer Aslan
  2. Refik Samet

In Signal Processing

  1. Ömer Aslan
  2. Refik Samet

Citations in the corpus