Abstract
With the popularization of smartphones, the number of mobile applications has grown substantially. However, many malware are emerging and thus pose a serious threat to the user’s mobile phones. Malware detection has become a public concern that requires urgent resolution. In this paper, we propose MulAV, a multilevel and explainable detection method with data fusion. Our method obtain information from multiple levels (the APP source code, network traffic, and geospatial information) and combine it with machine learning method to train a model which can identify mobile malware with high accuracy and few false alarms. Experimental result shows that MulAV outperforms other anti-virus scanners and methods and achieves a detection rate of 97.8% with 0.4% false alarms. Furthermore, for the benefit of users, MulAV displays the explanation for each detection, thus revealing relevant properties of the detected malware.
Supported by the National Natural Science Foundation of China under Grants No. 61672262, No. 61573166 and No. 61572230, the Shandong Provincial Key R&D Program under Grant No. 2016GGX101001, No. 2016GGX101008, No. 2018CXGC0706 and No. 2016ZDJS01A09, the TaiShan Industrial Experts Programme of Shandong Province under Grants No. tscy20150305, CERNET Next Generation Internet Technology Innovation Project under Grant No. NGII20160404.
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
References
Geoip. https://dev.maxmind.com/zh-hans/geoip/legacy/geolite/
Mobile-security-framework. https://github.com/MobSF/Mobile-Security-Framework-MobSF
Virusshare. https://virusshare.com/
Virustotal. https://www.virustotal.com/
Number of available applications in the google play store. Technical report. https://www.statista.com/statistics/266210/number-of-available-applications-in-the-google-play-store (2017)
Arp, D., Spreitzenbarth, M., Hubner, M., Gascon, H., Rieck, K., Siemens, C.: DREBIN: effective and explainable detection of android malware in your pocket. In: Ndss, vol. 14, pp. 23–26 (2014)
Cao, D., et al.: Droidcollector: a high performance framework for high quality android traffic collection. In: 2016 IEEE Trustcom/BigDataSE/ISPA, pp. 1753–1758. IEEE (2016)
Chakraborty, T., Pierazzi, F., Subrahmanian, V.: EC2: ensemble clustering and classification for predicting android malware families. IEEE Trans. Dependable Secur. Comput., 1 (2017)
Enck, W., et al.: TaintDroid: an information-flow tracking system for realtime privacy monitoring on smartphones. ACM Trans. Comput. Syst. (TOCS) 32(2), 5 (2014)
Hypponen, M.: Malware goes mobile. Sci. Am. 295(5), 70–77 (2006)
Narudin, F.A., Feizollah, A., Anuar, N.B., Gani, A.: Evaluation of machine learning classifiers for mobile malware detection. Soft Comput. 20(1), 343–357 (2016)
Octeau, D., et al.: Combining static analysis with probabilistic models to enable market-scale android inter-component analysis. In: ACM SIGPLAN Notices, vol. 51, pp. 469–484. ACM (2016)
Saracino, A., Sgandurra, D., Dini, G., Martinelli, F.: MADAM: effective and efficient behavior-based android malware detection and prevention. IEEE Trans. Dependable Secur. Comput. 15, 83–97 (2016)
Spreitzenbarth, M., Schreck, T., Echtler, F., Arp, D., Hoffmann, J.: Mobile-Sandbox: combining static and dynamic analysis with machine-learning techniques. Int. J. Inf. Secur. 14(2), 141–153 (2015)
Suarez-Tangil, G., Dash, S.K., Ahmadi, M., Kinder, J., Giacinto, G., Cavallaro, L.: DroidSieve: fast and accurate classification of obfuscated android malware. In: Proceedings of the Seventh ACM on Conference on Data and Application Security and Privacy, pp. 309–320. ACM (2017)
Tong, F., Yan, Z.: A hybrid approach of mobile malware detection in android. J. Parallel Distrib. Comput. 103, 22–31 (2017)
Wang, S., et al.: TrafficAV: an effective and explainable detection of mobile malware behavior using network traffic. In: 2016 IEEE/ACM 24th International Symposium on Quality of Service (IWQoS), pp. 1–6. IEEE (2016)
Wong, M.Y., Lie, D.: IntelliDroid: a targeted input generator for the dynamic analysis of android malware. In: NDSS, vol. 16, pp. 21–24 (2016)
Zhang, J.: Research of Android application security. Ph.D. thesis, Beijing University of Posts and Telecommunications (2013)
Author information
Authors and Affiliations
Corresponding author
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2018 Springer Nature Switzerland AG
About this paper
Cite this paper
Li, Q. et al. (2018). MulAV: Multilevel and Explainable Detection of Android Malware with Data Fusion. In: Vaidya, J., Li, J. (eds) Algorithms and Architectures for Parallel Processing. ICA3PP 2018. Lecture Notes in Computer Science(), vol 11337. Springer, Cham. https://doi.org/10.1007/978-3-030-05063-4_14
Download citation
DOI: https://doi.org/10.1007/978-3-030-05063-4_14
Published:
Publisher Name: Springer, Cham
Print ISBN: 978-3-030-05062-7
Online ISBN: 978-3-030-05063-4
eBook Packages: Computer ScienceComputer Science (R0)