Empirical study of malware diversity in major Android markets. Issue 2 (3rd April 2018)

• Record Type: Journal Article
• Authors: Soto-Valero, César; González, Mabel
• Is Part Of: Journal of cyber security technology. Volume 2:Issue 2(2018)
• Page Start: 51
• Page End: 74
• Publication Date: 2018-04-03
• Subjects: Android OS -- malware analysis -- diversity measures -- anti-malware scanning results -- agglomerative hierarchical clustering; Computer security -- Periodicals; Data encryption (Computer science) -- Periodicals; 005.805
• DOI: 10.1080/23742917.2018.1483876
• Languages: English
• ISSNs: 2374-2917

Abstract

ABSTRACT: The popularity of Android has motivated a significant increase in the amount of malware specially designed to target this operating system. During the last years, the threat has become more serious and every day cybercriminals create and share new specimens through almost all existing markets. This situation has promoted a notable research interest in the development of automated malware detection and classification systems. In this paper, we perform a large-scale empirical study to examine the diversity of Android malware in major markets. Through the analysis of more than 5 million of apps, we use the labels assigned by 57 different anti-malware vendors and diversity measures to get insights about the distribution and evolution of Android malware. Furthermore, we propose a dissimilarity measure for comparing these labels, which can be applied as part of an agglomerative hierarchical clustering algorithm. This clustering method groups the labels according to the scanning reports of different anti-malware vendors. The results obtained make evident an increase in the diversification of malware in both official and alternative markets. Moreover, we show how the criteria of various anti-malware, in conjunction with clustering techniques, is a suitable approach for grouping and analysing malware samples that perform a similar behaviour.