An HMM and structural entropy based detector for Android malware: An empirical study. Issue 61 (August 2016)

• Record Type: Journal Article
• Authors: Canfora, Gerardo; Mercaldo, Francesco; Visaggio, Corrado Aaron
• Is Part Of: Computers & security. Issue 61(2016)
• Page Start: 1
• Page End: 18
• Publication Date: 2016-08
• Subjects: Malware -- Mobile -- HMM -- Entropy -- Android; Computer security -- Periodicals; Electronic data processing departments -- Security measures -- Periodicals; 005.805
• DOI: 10.1016/j.cose.2016.04.009
• Languages: English
• ISSNs: 0167-4048

Abstract

Abstract: Smartphones are becoming more and more popular and, as a consequence, malware writers are increasingly engaged to develop new threats and propagate them through official and third-party markets. In addition to the propagation vectors, malware is also evolving quickly the techniques adopted for infecting victims and hiding their malicious nature to antimalware scanning. From SMS Trojans to legitimate applications repacked with malicious payload, from AES encrypted root exploits to the dynamic loading of a payload retrieved from a remote server: malicious code is becoming more and more hard to detect. In this paper we experimentally evaluate two techniques for detecting Android malware: the first one is based on Hidden Markov Model, while the second one exploits structural entropy. These two techniques have been successfully applied to detect PCs viruses in previous works, and only one work in literature analyzes the application of HMM to the detection of Android malware. We demonstrate that these methods, which reveal effective for PCs virus, are also successful for detecting and classifying mobile malware. Our results are promising: we obtain a precision of 0.96 to discriminate a malware application, and a precision of 0.978 to identify the malware family.