Android malware detection based on permission combinations. (2015)

• Record Type: Journal Article
• Authors: Liu, Zenghui; Lai, Yingxu; Chen, Yinong
• Is Part Of: International journal of simulation and process modelling. Volume 10:Number 4(2015)
• Page Start: 315
• Page End: 326
• Publication Date: 2015
• Subjects: Android malware -- imbalanced datasets -- integrated learning -- permission-based mechanisms -- malware detection -- permission combinations -- mobile terminals -- memory capacity -- battery power -- threat levels -- feature selection -- self-learning -- feature extraction -- minimum risk Bayes algorithm; Management -- Computer simulation -- Periodicals; Mathematical models -- Periodicals; Operations research -- Periodicals; Simulation methods -- Periodicals; 003.05
• Languages: English
• ISSNs: 1740-2123

Abstract

Considering the resource limitations of mobile terminals, such as memory capacity and battery power, it will take a large portion of resources if the complex malicious detection system is implemented in mobile terminals. We proposed the training part to be implemented on the backend server and the detecting part to be implemented on the mobile terminals. In addition, we apply permission information to the applications installed on the terminals, because permission mechanism controls the applications' accesses to sensitive information. In our method, we first employ apriori algorithm to define the permission combinations to be the initial feature and calculate the threat level of permission based on the relative deviation distances. The distances are then used as weights to the classification algorithm. In the process, we apply an integrated feature selection approach based on the principle of self-learning to extract important features to form the feature set. Finally, the minimum risk Bayes algorithm is introduced to classify unknown applications. The experimental results show that our method is effective on imbalanced datasets.