Skip to main content

Statistical Learning Applied to Malware Detection

  • Conference paper
  • First Online:
Artificial Intelligence and Applied Mathematics in Engineering Problems (ICAIAME 2019)

Abstract

This work shows an application of statistical learning methodologies in order to determine the important factors for malware detection. Support Vector Machines and Lasso Regression performed Malware classification with additional re-sampling methods. The results show that the Lasso Regression allows an efficient selection of relevant variables for the construction of the classifier, also the integration of support vector machines improves the efficiency of the classifier through the application of resampling methods. The model presented in this paper uses a statistical learning approach through the selection of variables, non-linear classification, and resampling methods.

This is a preview of subscription content, log in via an institution to check access.

Access this chapter

Chapter
USD 29.95
Price excludes VAT (USA)
  • Available as PDF
  • Read on any device
  • Instant download
  • Own it forever
eBook
USD 129.00
Price excludes VAT (USA)
  • Available as EPUB and PDF
  • Read on any device
  • Instant download
  • Own it forever
Softcover Book
USD 169.99
Price excludes VAT (USA)
  • Compact, lightweight edition
  • Dispatched in 3 to 5 business days
  • Free shipping worldwide - see info

Tax calculation will be finalised at checkout

Purchases are for personal use only

Institutional subscriptions

References

  1. Kaspersky Lab: Machine learning for malware detection. Kaspersky for Bussines (2019)

    Google Scholar 

  2. Gavrilut D., Cimpoesu M., Anton D., Ciortuz, L.: Malware detection using machine learning. In: Proceedings of the International Multiconference on Computer Science and Information Technology, pp. 735–741 (2009)

    Google Scholar 

  3. Aydogan, E., Sen, S.: Analysis of machine learning methods on malware detection. In: 22nd Signal Processing and Communications Applications Conference (2014)

    Google Scholar 

  4. Xiao, F., Lin, Z., Sun, Y., Ma, Y.: Malware detection based on deep learning of behavior graphs. Math. Prob. Eng. 2019, 10 (2019)

    Google Scholar 

  5. Amalina, F., Feizollah, A., Bradul, N., Gani, A.: Evaluation of machine learning classifiers for mobile malware detection. Soft Comput. 20(1), 343–357 (2016)

    Article  Google Scholar 

  6. Rieck, K., Holz, T., Willems, C., Dussel, P., Laskov, P.: Learning and classification of malware behavior. In: International Conference on Detection of Intrusions and Malware, and Vulnerability Assesment (2008)

    Google Scholar 

  7. Santos, I., Nieves, J., Bringas, P.: Semi-supervised learning for unknown malware detection. In: Abraham, A., Corchado, J.M., González, S.R., De Paz Santana, J.F. (eds.) International Symposium on Distributed Computing and Artificial Intelligence. Advances in Intelligent and Soft Computing, vol. 91. Springer, Heidelberg (2011)

    Google Scholar 

  8. Hou, Y., Chang, Y., Chen, T., Laih, C., Chen, C.: Malicious web content detection by machine learning. Expert Syst. Appl. 37(1), 55–60 (2010)

    Article  Google Scholar 

  9. Markel, Z., Bilzor, M.: Building a machine learning classifier for malware detection. In: Second Workshop on Anti-malware Testing Research (WATeR) (2014)

    Google Scholar 

  10. Martín, I., et al.: Android malware characterization using metadata and machine learning techniques. Secur. Commun. Networks 2018, 11 (2018)

    Google Scholar 

  11. Yerima, S., et al.: DroidFusion: A novel multilevel classifier fusion approach for android malware detection. IEEE Trans. Cybern. 49, 453–466 (2018)

    Article  Google Scholar 

  12. Tibshirani, R.: Regression shrinkage and selection via the lasso. J. Roy. Stat. Soc. 58, 267–288 (1996)

    MathSciNet  MATH  Google Scholar 

  13. Cortes, C., Vapnik, V.: Support vector networks. Mach. Learn. 20, 273 (1995)

    MATH  Google Scholar 

  14. Hastie, T., Tibshirani, R., Friedman, J.: The Elements of Statistical Learning. Springer Series in Statistics: EU (2008)

    Google Scholar 

Download references

Author information

Authors and Affiliations

Authors

Corresponding author

Correspondence to Jose A. Marmolejo-Saucedo .

Editor information

Editors and Affiliations

Appendices

Annex I. Variables

Variable

Description

transact

API call signature

onServiceConnected

API call signature

bindService

API call signature

attachInterface

API call signature

ServiceConnection

API call signature

android.os.Binder

API call signature

SEND_SMS

Manifest Permission

Ljava.lang.Class.getCanonicalName

API call signature

Ljava.lang.Class.getMethods

API call signature

Ljava.lang.Class.cast

API call signature

Ljava.net.URLDecoder

API call signature

android.content.pm.Signature

API call signature

android.telephony.SmsManager

API call signature

READ_PHONE_STATE

Manifest Permission

getBinder

API call signature

ClassLoader

API call signature

Landroid.content.Context.registerReceiver

API call signature

Ljava.lang.Class.getField

API call signature

Landroid.content.Context.unregisterReceiver

API call signature

GET_ACCOUNTS

Manifest Permission

RECEIVE_SMS

Manifest Permission

Ljava.lang.Class.getDeclaredField

API call signature

READ_SMS

Manifest Permission

getCallingUid

API call signature

Ljavax.crypto.spec.SecretKeySpec

API call signature

android.intent.action.BOOT_COMPLETED

Intent

USE_CREDENTIALS

Manifest Permission

MANAGE_ACCOUNTS

Manifest Permission

android.content.pm.PackageInfo

API call signature

KeySpec

API call signature

TelephonyManager.getLine1Number

API call signature

DexClassLoader

API call signature

HttpGet.init

API call signature

SecretKey

API call signature

Ljava.lang.Class.getMethod

API call signature

System.loadLibrary

API call signature

android.intent.action.SEND

API call signature

Ljavax.crypto.Cipher

API call signature

WRITE_SMS

Manifest Permission

READ_SYNC_SETTINGS

Manifest Permission

AUTHENTICATE_ACCOUNTS

Manifest Permission

android.telephony.gsm.SmsManager

API call signature

WRITE_HISTORY_BOOKMARKS

Manifest Permission

TelephonyManager.getSubscriberId

API call signature

mount

Commands signature

INSTALL_PACKAGES

Manifest Permission

Runtime.getRuntime

API call signature

CAMERA

Manifest Permission

Ljava.lang.Object.getClass

API call signature

WRITE_SYNC_SETTINGS

Manifest Permission

READ_HISTORY_BOOKMARKS

Manifest Permission

Ljava.lang.Class.forName

API call signature

INTERNET

Manifest Permission

android.intent.action.PACKAGE_REPLACED

Intent

Binder

API call signature

android.intent.action.SEND_MULTIPLE

Intent

RECORD_AUDIO

Manifest Permission

IBinder

API call signature

android.os.IBinder

API call signature

createSubprocess

API call signature

NFC

Manifest Permission

ACCESS_LOCATION_EXTRA_COMMANDS

Manifest Permission

URLClassLoader

API call signature

WRITE_APN_SETTINGS

Manifest Permission

abortBroadcast

API call signature

BIND_REMOTEVIEWS

Manifest Permission

android.intent.action.TIME_SET

Intent

READ_PROFILE

Manifest Permission

TelephonyManager.getDeviceId

API call signature

MODIFY_AUDIO_SETTINGS

Manifest Permission

getCallingPid

API call signature

READ_SYNC_STATS

Manifest Permission

BROADCAST_STICKY

Manifest Permission

android.intent.action.PACKAGE_REMOVED

Intent

android.intent.action.TIMEZONE_CHANGED

Intent

WAKE_LOCK

Manifest Permission

RECEIVE_BOOT_COMPLETED

Manifest Permission

RESTART_PACKAGES

Manifest Permission

Ljava.lang.Class.getPackage

API call signature

chmod

Commands signature

Ljava.lang.Class.getDeclaredClasses

API call signature

android.intent.action.ACTION_POWER_DISCONNECTED

Intent

android.intent.action.PACKAGE_ADDED

Intent

PathClassLoader

API call signature

TelephonyManager.getSimSerialNumber

API call signature

Runtime.load

API call signature

TelephonyManager.getCallState

API call signature

BLUETOOTH

Manifest Permission

READ_CALENDAR

Manifest Permission

READ_CALL_LOG

Manifest Permission

SUBSCRIBED_FEEDS_WRITE

Manifest Permission

READ_EXTERNAL_STORAGE

Manifest Permission

TelephonyManager.getSimCountryIso

API call signature

sendMultipartTextMessage

API call signature

PackageInstaller

API call signature

VIBRATE

Manifest Permission

remount

Commands signature

android.intent.action.ACTION_SHUTDOWN

Intent

sendDataMessage

API call signature

ACCESS_NETWORK_STATE

Manifest Permission

chown

Commands signature

HttpPost.init

API call signature

Ljava.lang.Class.getClasses

API call signature

SUBSCRIBED_FEEDS_READ

Manifest Permission

TelephonyManager.isNetworkRoaming

API call signature

CHANGE_WIFI_MULTICAST_STATE

Manifest Permission

WRITE_CALENDAR

Manifest Permission

android.intent.action.PACKAGE_DATA_CLEARED

Intent

MASTER_CLEAR

Manifest Permission

HttpUriRequest

API call signature

UPDATE_DEVICE_STATS

Manifest Permission

WRITE_CALL_LOG

Manifest Permission

DELETE_PACKAGES

Manifest Permission

GET_TASKS

Manifest Permission

GLOBAL_SEARCH

Manifest Permission

DELETE_CACHE_FILES

Manifest Permission

WRITE_USER_DICTIONARY

Manifest Permission

android.intent.action.PACKAGE_CHANGED

Intent

android.intent.action.NEW_OUTGOING_CALL

Intent

REORDER_TASKS

Manifest Permission

WRITE_PROFILE

Manifest Permission

SET_WALLPAPER

Manifest Permission

BIND_INPUT_METHOD

Manifest Permission

divideMessage

API call signature

READ_SOCIAL_STREAM

Manifest Permission

READ_USER_DICTIONARY

Manifest Permission

PROCESS_OUTGOING_CALLS

Manifest Permission

CALL_PRIVILEGED

Manifest Permission

Runtime.exec

API call signature

BIND_WALLPAPER

Manifest Permission

RECEIVE_WAP_PUSH

Manifest Permission

DUMP

Manifest Permission

BATTERY_STATS

Manifest Permission

ACCESS_COARSE_LOCATION

Manifest Permission

SET_TIME

Manifest Permission

android.intent.action.SENDTO

Intent

WRITE_SOCIAL_STREAM

Manifest Permission

WRITE_SETTINGS

Manifest Permission

REBOOT

Manifest Permission

BLUETOOTH_ADMIN

Manifest Permission

TelephonyManager.getNetworkOperator

API call signature

/system/bin

Commands signature

MessengerService

API call signature

BIND_DEVICE_ADMIN

Manifest Permission

WRITE_GSERVICES

Manifest Permission

IRemoteService

API call signature

KILL_BACKGROUND_PROCESSES

Manifest Permission

SET_ALARM

API call signature

ACCOUNT_MANAGER

API call signature

/system/app

Commands signature

android.intent.action.CALL

Intent

STATUS_BAR

Manifest Permission

TelephonyManager.getSimOperator

API call signature

PERSISTENT_ACTIVITY

Manifest Permission

CHANGE_NETWORK_STATE

Manifest Permission

onBind

API call signature

Process.start

API call signature

android.intent.action.SCREEN_ON

Intent

Context.bindService

API call signature

RECEIVE_MMS

Manifest Permission

SET_TIME_ZONE

Manifest Permission

android.intent.action.BATTERY_OKAY

Intent

CONTROL_LOCATION_UPDATES

Manifest Permission

BROADCAST_WAP_PUSH

Manifest Permission

BIND_ACCESSIBILITY_SERVICE

Manifest Permission

ADD_VOICEMAIL

Manifest Permission

CALL_PHONE

Manifest Permission

ProcessBuilder

API call signature

BIND_APPWIDGET

Manifest Permission

FLASHLIGHT

Manifest Permission

READ_LOGS

Manifest Permission

Ljava.lang.Class.getResource

API call signature

defineClass

API call signature

SET_PROCESS_LIMIT

Manifest Permission

android.intent.action.PACKAGE_RESTARTED

Intent

MOUNT_UNMOUNT_FILESYSTEMS

Manifest Permission

BIND_TEXT_SERVICE

Manifest Permission

INSTALL_LOCATION_PROVIDER

Manifest Permission

android.intent.action.CALL_BUTTON

Intent

android.intent.action.SCREEN_OFF

Intent

findClass

API call signature

SYSTEM_ALERT_WINDOW

Manifest Permission

MOUNT_FORMAT_FILESYSTEMS

Manifest Permission

CHANGE_CONFIGURATION

Manifest Permission

CLEAR_APP_USER_DATA

Manifest Permission

intent.action.RUN

Intent

android.intent.action.SET_WALLPAPER

Intent

CHANGE_WIFI_STATE

Manifest Permission

READ_FRAME_BUFFER

Manifest Permission

ACCESS_SURFACE_FLINGER

Manifest Permission

Runtime.loadLibrary

API call signature

BROADCAST_SMS

Manifest Permission

EXPAND_STATUS_BAR

Manifest Permission

INTERNAL_SYSTEM_WINDOW

Manifest Permission

android.intent.action.BATTERY_LOW

Intent

SET_ACTIVITY_WATCHER

Manifest Permission

WRITE_CONTACTS

Manifest Permission

android.intent.action.ACTION_POWER_CONNECTED

Intent

BIND_VPN_SERVICE

Manifest Permission

DISABLE_KEYGUARD

Manifest Permission

ACCESS_MOCK_LOCATION

Manifest Permission

GET_PACKAGE_SIZE

Manifest Permission

MODIFY_PHONE_STATE

Manifest Permission

CHANGE_COMPONENT_ENABLED_STATE

Manifest Permission

CLEAR_APP_CACHE

Manifest Permission

SET_ORIENTATION

Manifest Permission

READ_CONTACTS

Manifest Permission

DEVICE_POWER

Manifest Permission

HARDWARE_TEST

Manifest Permission

ACCESS_WIFI_STATE

Manifest Permission

WRITE_EXTERNAL_STORAGE

Manifest Permission

ACCESS_FINE_LOCATION

Manifest Permission

SET_WALLPAPER_HINTS

Manifest Permission

SET_PREFERRED_APPLICATIONS

Manifest Permission

WRITE_SECURE_SETTINGS

Manifest Permission

class

B = Benign

Annex II. Coefficients of Lasso Regression

Variable

Coefficient

createSubprocess

0.264244253

SEND_SMS

0.258899979

INTERNET

0.207230368

android.telephony.gsm.SmsManager

0.202311101

android.telephony.SmsManager

0.170603554

CONTROL_LOCATION_UPDATES

0.167463464

chmod

0.129396768

DELETE_CACHE_FILES

0.128579622

SET_TIME

0.126521959

READ_SMS

0.124454019

READ_HISTORY_BOOKMARKS

0.12137216

HttpUriRequest

0.118544076

ACCESS_LOCATION_EXTRA_COMMANDS

0.113866999

MODIFY_PHONE_STATE

0.105379828

WRITE_SOCIAL_STREAM

0.097755195

SUBSCRIBED_FEEDS_READ

0.096845453

WRITE_PROFILE

0.094601544

Runtime.exec

0.086924025

DUMP

0.083824425

READ_PHONE_STATE

0.083395724

UPDATE_DEVICE_STATS

0.083345931

TelephonyManager.getLine1Number

0.079018974

SecretKey

0.074446082

Ljava.lang.Class.getResource

0.074278545

android.intent.action.PACKAGE_RESTARTED

0.072230441

PERSISTENT_ACTIVITY

0.070560713

android.intent.action.BOOT_COMPLETED

0.066059447

TelephonyManager.getDeviceId

0.065452464

CLEAR_APP_CACHE

0.065119831

TelephonyManager.getSubscriberId

0.064089987

WRITE_HISTORY_BOOKMARKS

0.063187614

SET_ALARM

0.062644562

BIND_WALLPAPER

0.061718151

SET_ORIENTATION

0.061584459

onBind

0.057236584

remount

0.052002868

SET_WALLPAPER

0.050447888

GLOBAL_SEARCH

0.050315561

divideMessage

0.042985093

android.intent.action.BATTERY_LOW

0.039620621

DexClassLoader

0.038455601

X.system.bin

0.037747743

mount

0.037456259

android.intent.action.NEW_OUTGOING_CALL

0.036929947

ACCESS_COARSE_LOCATION

0.036554244

findClass

0.036472269

ACCESS_WIFI_STATE

0.035110756

SYSTEM_ALERT_WINDOW

0.034679765

SET_WALLPAPER_HINTS

0.032870177

PROCESS_OUTGOING_CALLS

0.031816527

MANAGE_ACCOUNTS

0.030118538

Ljava.lang.Class.getMethod

0.029238659

AUTHENTICATE_ACCOUNTS

0.029026365

android.intent.action.CALL_BUTTON

0.028889754

defineClass

0.028221046

READ_FRAME_BUFFER

0.023514533

PackageInstaller

0.018827645

KeySpec

0.018161017

Ljava.lang.Class.getDeclaredField

0.016860114

WRITE_APN_SETTINGS

0.016567216

intent.action.RUN

0.015230216

BLUETOOTH

0.013431058

android.intent.action.BATTERY_OKAY

0.013242983

android.intent.action.PACKAGE_ADDED

0.010809145

HARDWARE_TEST

0.010537673

Ljava.lang.Class.getPackage

0.010420027

getCallingPid

0.009211549

android.intent.action.PACKAGE_CHANGED

0.008287811

Ljava.lang.Class.getClasses

0.008147411

WRITE_EXTERNAL_STORAGE

0.006609881

RECEIVE_WAP_PUSH

0.006325588

PathClassLoader

0.005271246

CHANGE_WIFI_STATE

0.004566972

FLASHLIGHT

0.004039508

Ljava.lang.Class.forName

0.003478003

android.intent.action.TIMEZONE_CHANGED

0.001800096

READ_SOCIAL_STREAM

0.001715007

DISABLE_KEYGUARD

0.000932628

BIND_INPUT_METHOD

0.000500278

GET_TASKS

0.000274389

BIND_ACCESSIBILITY_SERVICE

−0.00026438

RESTART_PACKAGES

−0.00148047

android.os.IBinder

−0.00279385

TelephonyManager.getSimCountryIso1

−0.00288437

Ljava.lang.Class.getField

−0.00296154

IBinder

−0.00342076

BROADCAST_SMS

−0.00398095

SUBSCRIBED_FEEDS_WRITE

−0.00454201

ACCESS_NETWORK_STATE

−0.00459926

bindService

−0.00471922

READ_EXTERNAL_STORAGE

−0.00519205

android.intent.action.SENDTO

−0.00563882

Ljava.lang.Class.cast

−0.00718701

STATUS_BAR

−0.0093266

REBOOT

−0.00970475

NFC

−0.00980768

android.os.Binder

−0.01051688

CHANGE_CONFIGURATION

−0.01179464

RECEIVE_SMS

−0.01204579

BLUETOOTH_ADMIN

−0.0139069

android.intent.action.PACKAGE_DATA_CLEARED

−0.01435001

X.system.app

−0.01479621

BIND_APPWIDGET

−0.01481123

getBinder

−0.01611587

WAKE_LOCK

−0.01650988

TelephonyManager.getCallState

−0.01720881

BROADCAST_STICKY

−0.01764756

TelephonyManager.getNetworkOperator

−0.01889666

WRITE_SECURE_SETTINGS

−0.01918746

WRITE_USER_DICTIONARY

−0.01993922

KILL_BACKGROUND_PROCESSES

−0.02030457

android.intent.action.SEND

−0.02039022

READ_SYNC_SETTINGS

−0.0208841

android.content.pm.PackageInfo

−0.02119871

Landroid.content.Context.registerReceiver

−0.02174869

READ_CONTACTS

−0.02274993

CAMERA

−0.02403828

RECORD_AUDIO

−0.02466568

TelephonyManager.getSimSerialNumber

−0.02478753

chown

−0.02591173

abortBroadcast

−0.02719413

Ljava.lang.Class.getCanonicalName

−0.0271965

Ljava.lang.Class.getMethods

−0.02771707

IRemoteService

−0.02791817

CALL_PHONE

−0.03090892

android.intent.action.SCREEN_ON

−0.03210006

BROADCAST_WAP_PUSH

−0.03226206

HttpPost.init

−0.03234517

WRITE_SMS

−0.0324788

TelephonyManager.getSimOperator

−0.03469507

android.intent.action.ACTION_POWER_DISCONNECTED

−0.03616017

BATTERY_STATS

−0.0364922

android.intent.action.SCREEN_OFF

−0.03728614

INSTALL_LOCATION_PROVIDER

−0.03791462

READ_SYNC_STATS

−0.03810809

attachInterface

−0.03829324

Ljavax.crypto.Cipher

−0.03949882

INSTALL_PACKAGES

−0.03961002

android.intent.action.SET_WALLPAPER

−0.04164843

MASTER_CLEAR

−0.04187666

onServiceConnected

−0.04191473

Process.start

−0.04247342

transact

−0.04265317

ProcessBuilder

−0.04321857

GET_PACKAGE_SIZE

−0.04354681

USE_CREDENTIALS

−0.04364622

android.intent.action.PACKAGE_REMOVED

−0.04367305

Landroid.content.Context.unregisterReceiver

−0.04397466

WRITE_CALL_LOG

−0.04446323

CALL_PRIVILEGED

−0.04503315

READ_LOGS

−0.04560355

WRITE_CONTACTS

−0.04869014

ACCOUNT_MANAGER

−0.05009465

Ljava.lang.Class.getDeclaredClasses

−0.05091621

Ljava.lang.Object.getClass

−0.0509497

android.intent.action.PACKAGE_REPLACED

−0.05162474

WRITE_SETTINGS

−0.05171949

CLEAR_APP_USER_DATA

−0.05230378

GET_ACCOUNTS

−0.05414448

WRITE_CALENDAR

−0.05974735

System.loadLibrary

−0.06144877

MODIFY_AUDIO_SETTINGS

−0.06205213

ADD_VOICEMAIL

−0.06566482

TelephonyManager.isNetworkRoaming

−0.06653053

READ_PROFILE

−0.06791394

ACCESS_MOCK_LOCATION

−0.06795926

Binder

−0.06942009

CHANGE_NETWORK_STATE

−0.07220123

RECEIVE_MMS

−0.0792903

URLClassLoader

−0.07967425

Ljavax.crypto.spec.SecretKeySpec

−0.08006777

android.intent.action.ACTION_SHUTDOWN

−0.08283051

WRITE_GSERVICES

−0.08450157

MOUNT_UNMOUNT_FILESYSTEMS

−0.08603744

android.intent.action.TIME_SET

−0.08665047

Context.bindService

−0.08838194

CHANGE_WIFI_MULTICAST_STATE

−0.08942738

HttpGet.init

−0.09067209

ClassLoader

−0.09084002

CHANGE_COMPONENT_ENABLED_STATE

−0.10764022

Ljava.net.URLDecoder

−0.10774214

Runtime.load

−0.10884032

ACCESS_SURFACE_FLINGER

−0.11486367

READ_CALL_LOG

−0.12663504

BIND_DEVICE_ADMIN

−0.13304341

SET_ACTIVITY_WATCHER

−0.15191197

SET_TIME_ZONE

−0.18878256

SET_PROCESS_LIMIT

−0.19163698

sendMultipartTextMessage

−0.34691918

Rights and permissions

Reprints and permissions

Copyright information

© 2020 Springer Nature Switzerland AG

About this paper

Check for updates. Verify currency and authenticity via CrossMark

Cite this paper

Rodriguez-Aguilar, R., Marmolejo-Saucedo, J.A. (2020). Statistical Learning Applied to Malware Detection. In: Hemanth, D., Kose, U. (eds) Artificial Intelligence and Applied Mathematics in Engineering Problems. ICAIAME 2019. Lecture Notes on Data Engineering and Communications Technologies, vol 43. Springer, Cham. https://doi.org/10.1007/978-3-030-36178-5_22

Download citation

Publish with us

Policies and ethics