Behaviour analysis of inter-app communication using a lightweight monitoring app for malware detection. (30th December 2022)

• Record Type: Journal Article
• Authors: Grace, M.; Sughasiny, M.
• Is Part Of: Expert systems with applications. Volume 210(2022)
• Publication Date: 2022-12-30
• Subjects: Malware detection -- Behaviour analysis -- Lightweight monitoring app -- Permission based evaluation -- Policy-based permissions; Expert systems (Computer science) -- Periodicals; Systèmes experts (Informatique) -- Périodiques; Electronic journals; 006.33
• DOI: 10.1016/j.eswa.2022.118404
• Languages: English
• ISSNs: 0957-4174

Abstract

Highlights: Detecting malicious applications using a proposed lightweight monitoring system. Malware apps detected by behaviour analysis of the app activities with log files. Policy-based permissions are evaluated from those log files for behaviour analysis. Then the malware apps will be denied or granted to use other apps' permissions. Our design acquired accuracy of 95% comparing with existing ones. Abstract: Smartphone communications are becoming more and more useful for businesses to plan and organize their work and are mainly operated with android applications. The development of android applications has increased the curiosity of using the smartphone and also has many loopholes for the attackers to trigger the malicious activity. The detection of malicious activity is known as malware detection. Malware collusion is a new threat approach in which two or more malicious apps combine to accomplish their goals due to the fact that each app may appear benign to standard detection methods. To detect the malicious app, a behaviour analysis app is used to detect the communication between the two or more apps. Malicious application detection is a difficult task, especially because the user is sometimes entirely ignorant of the behaviour of the applications placed on their device. In this paper, the proposed model is a lightweight monitoring system used to detect malware by the behaviour analysis of the app. The designed model monitors the behaviour of the app by checking the app activities with the log file. These Log files consist of real-time activities and permissions of the app. Policy-based permissions are evaluated, and according to that, the malware apps are denied or granted to use the permissions of the other app. This designed model is implemented on Python 3.8 for performance metrics such as accuracy, precision, execution time, error, etc. The acquired accuracy for the proposed model is 95%, which is greater compared to the existing techniques such as MoDroid, CrowDroid and dl -Droid. Thus, the proposed model instantly detects the malware app based on the evaluation of the policy-based permissions.