Differentiating Malicious and Benign Android App Operations Using Second‐Step Behavior Features. Issue 5 (1st September 2019)

• Record Type: Journal Article
• Authors: LI, Pengwei; FU, Jianming; XU, Chao; CHENG, Binlin; ZHANG, Huanguo
• Is Part Of: Chinese journal of electronics. Volume 28:Issue 5(2019)
• Page Start: 944
• Page End: 952
• Publication Date: 2019-09-01
• Subjects: Android malware -- Security‐sensitive operations -- Static program analysis -- Classification; Android (operating system) -- invasive software -- mobile computing -- program diagnostics; benign Android app operations -- second‐step behavior features -- security‐sensitive operation -- Android applications -- static program analysis -- app analysis -- structural features -- semantic features -- malicious Android app operations -- SSBF; Electronics -- Periodicals; Electronics -- China -- Periodicals; Electronics; China; Periodicals; 621.38105
• DOI: 10.1049/cje.2019.06.014
• Languages: English
• ISSNs: 1022-4653

Abstract

Abstract : Security‐sensitive operations in Android applications (apps for short) can either be benign or malicious. In this work, we introduce an approach of static program analysis that extracts fisecond‐step behavior featuresfl, i.e., what was triggered by the security‐sensitive operation, to assist app analysis in differentiating between malicious and benign operations. Firstly, we summarized the characteristics of malicious operations, such as spontaneity, independence, stealthiness and continuity, which can be used to classify the malicious operations and benign ones. Secondly, according to these characteristics, Second step behavior features (SSBFs for short) have been presented, including structural features and semantic features. Thirdly, an analysis prototype named SSdroid has been implemented to automatically extract SSBFs of security‐sensitive operations. Finally, experiments on 9285 operations from both benign and malicious apps show that SSBFs are effective and usefulness. Our evaluation results suggest that the second‐step behavior can greatly assist in Android malware detection.