Identifying malicious Android apps using permissions and system events. (2016)

• Record Type: Journal Article
• Authors: Han, Hongmu; Li, Ruixuan; Gu, Xiwu
• Is Part Of: International journal of embedded systems. Volume 8:Number 1(2016)
• Page Start: 46
• Page End: 58
• Publication Date: 2016
• Subjects: malware -- risk communication defence -- embedded systems -- malicious app identification -- malicious apps -- Android apps -- permissions -- system events -- machine learning; Embedded computer systems -- Periodicals; 004.16
• Languages: English
• ISSNs: 1741-1068

Abstract

With the popularity of the Android platform, more and more hackers take the Android platform as the profitable target. Android provides a risk communication defence mechanism against malicious applications, which has been demonstrated to be ineffective. It is common to quickly identify malicious applications by permission-based analysis methods. Recently, those permission-based methods are becoming useless when more and more applications request dangerous permissions. The proposed approaches are based on the key insight that the difference in the components trigger model in malware applications and benign applications. The malwares are interested in monitoring system broadcast to activate malicious components and request more permissions. The benign applications are preferable to receive self-define broadcast to activate their components and ask fewer permissions. Existing permission-based Android malware check methods can identify nearly 81% malware samples, but they also identify many normal applications as malware. In this paper, we extend the permission-based approach and employ machine learning approaches to identify the malicious applications. We use the datasets of the Market 2011, Market 2012, Market 2013 and Malware to evaluate the proposed methods. The experimental results illustrate the effectiveness of our proposal.