MaMaDroid: Detecting Android Malware by Building Markov Chains of Behavioral Models
By Enrico Mariconti, Lucky Onwuzurike, Panagiotis Andriotis, Emiliano De Cristofaro, Gordon J. Ross, Gianluca Stringhini. Network and Distributed System Security Symposium, 2016
481 citations recorded by the source corpus.
The rise in popularity of the Android platform has resulted in an explosion of malware threats targeting it. As both Android malware and the operating system itself constantly evolve, it is very challenging to design robust malware mitigation techniques that can operate for long periods of time without the need for modifications or costly re-training. In this paper, we present MaMaDroid, an Android malware detection system that relies on app behavior. MaMaDroid builds a behavioral model, in the form of a Markov chain, from the sequence of abstracted API calls performed by an app, and uses it to extract features and perform classification. By abstracting calls to their packages or families, MaMaDroid maintains resilience to API changes and keeps the feature set size manageable. We evaluate its accuracy on a dataset of 8.5K benign and 35.5K malicious apps collected over a period of six years, showing that it not only effectively detects malware (with up to 99% F-measure), but also that the model built by the system keeps its detection capabilities for long periods of time (on average, 86% and 75% F-measure, respectively, one and two years after training). Finally, we compare against DroidAPIMiner, a state-of-the-art system that relies on the frequency of API calls performed by apps, showing that MaMaDroid significantly outperforms it.
Subfields: Computer Networks and Communications, Software, Signal Processing
View Paper: https://www.semanticscholar.org/paper/e8ee8fbf3a9eead394af0c8f93e02f88f7704a50
How researchers see this paper
The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.
In Computer Networks and Communications
- Jun Zhang
- Giorgio Severi
- Sheng Wen
- Surya Nepal
- Mourad Debbabi
- Johannes Kinder
- J. Meyer
- Fabio Pierazzi
In Software
- Sheng Wen
- Surya Nepal
- Fabio Pierazzi
- Lorenzo Cavallaro
- Roberto Jordaney
- Jun Zhang
- Feargus Pendlebury
- Yang Xiang
In Signal Processing
- Giorgio Severi
- Sheng Wen
- Surya Nepal
- Johannes Kinder
- J. Meyer
- Fabio Pierazzi
- Lorenzo Cavallaro
- Roberto Jordaney
Citations in the corpus
- Android HIV: A Study of Repackaging Malware for Evading Machine-Learning Detection (2018, methodology): “In [21], MaMaDroid’s performance was examined on three different machine learning classifiers.”
- Transcend: Detecting Concept Drift in Malware Classification Models (2017, background): “Literature [12, 15, 16] recommends retraining the model periodically (see § 6) to get around this.”
- TESSERACT: Eliminating Experimental Bias in Malware Classification across Space and Time (2018, methodology): “The second row of Table 2 reports an experiment in which a classifier’s ability to detect past objects is evaluated [2, 27].”
- Exploring Backdoor Poisoning Attacks Against Malware Classifiers (2020, background): “With the shift towards machine learning (ML) based classifiers, this second group has been split into two additional subcategories: feature based detectors [10, 37, 41, 42, 45], and raw-binary analyzers [21, 31, 39].”
- MalDozer: Automatic framework for android malware detection using deep learning (2018, methodology): “The results show that MalDozer detection is more resilient to API evolution over time compare to (Mariconti et al., 2017), as presented in Fig.”