Android Antivirus Scanner by Analyzing Operation Codes

Abstract:

This research presents a model for malware detection on mobile operating system based on analyzing the operation codes. The research processes are as follows: (1) achieving of both malicious and benign codes on android operating system, (2) extracting features based on the distribution of n-grams frequency where the parameter n = 3 is used, and (3) constructing a model for classification the malicious codes using the extracted features for both malicious and benign codes. In the experiment, 304 malicious codes and 553 benign codes were using to construct the model. The experiment shows that the model achieved more than 85.52% accuracy. For the sensitivity and specificity, the model achieved 71.26% and 90.52%, respectively.

• Periodical: Applied Mechanics and Materials (Volume 781)
• Pages: 145-148
• DOI: https://doi.org/10.4028/www.scientific.net/AMM.781.145
• Online since: August 2015
• Authors: Komal Narang, Kingkarn Sookhanaphibarn*, Prasong Praneetpolgrang
• Keywords: Feature Extraction, Malicious Code Detection, Support Vector Machine (SVM), Term Frequency

References

[1] Moskovitch, Robert, Yuval Elovici, and Lior Rokach. Detection of unknown computer worms based on behavioral classification of the host., Computational Statistics & Data Analysis 52, no. 9 (2008): 4544-4566.

DOI: 10.1016/j.csda.2008.01.028

[2] Abou-Assaleh, Tony, Nick Cercone, Vlado Keselj, and Ray Sweidan. N-gram-based detection of new malicious code., In Computer Software and Applications Conference, 2004. COMPSAC 2004. Proceedings of the 28th Annual International, vol. 2, pp.41-42. IEEE, (2004).

DOI: 10.1109/cmpsac.2004.1342667

[3] Kolter, Jeremy Z., and Marcus A. Maloof. Learning to detect malicious executables in the wild., Proceedings of the tenth ACM SIGKDD international conference on Knowledge discovery and data mining. ACM, (2004).

DOI: 10.1145/1014052.1014105

[4] Nolan, Godfrey. Decompiling Android. Apress, (2012).

[5] Jolliffe, Ian. Principal component analysis. John Wiley & Sons, Ltd, (2005).

[6] Maimon, Oded Z., and Lior Rokach, eds. Data mining and knowledge discovery handbook. Vol. 1. New York: Springer, (2005).

[7] Kohavi, Ron. A study of cross-validation and bootstrap for accuracy estimation and model selection., In IJCAI, vol. 14, no. 2, pp.1137-1145. (1995).