Malware Detection with Confidence Guarantees on Android Devices

  • Nestoras Georgiou
  • Andreas Konstantinidis
  • Harris Papadopoulos
Conference paper
Part of the IFIP Advances in Information and Communication Technology book series (IFIPAICT, volume 475)

Abstract

The evolution of ubiquitous smartphone devices has given rise to great opportunities with respect to the development of applications and services, many of which rely on sensitive user information. This explosion on the demand of smartphone applications has made them attractive to cybercriminals that develop mobile malware to gain access to sensitive data stored on smartphone devices. Traditional mobile malware detection approaches that can be roughly classified to signature-based and heuristic-based have essential drawbacks. The former rely on existing malware signatures and therefore cannot detect zero-day malware and the latter are prone to false positive detections. In this paper, we propose a heuristic-based approach that quantifies the uncertainty involved in each malware detection. In particular, our approach is based on a novel machine learning framework, called Conformal Prediction, for providing valid measures of confidence for each individual prediction, combined with a Multilayer Perceptron. Our experimental results on a real Android device demonstrate the empirical validity and both the informational and computational efficiency of our approach.

Keywords

Malware detection Android Security Inductive Conformal Prediction Confidence measures Multilayer Perceptron 

References

  1. 1.
    Cabir, smartphone malware (2004). http://www.f-secure.com/v-descs/cabir.shtml. Accessed 12 May 2016
  2. 2.
    G DATA, mobile malware report (threat report: Q4/2015) (2016). https://secure.gd/dl-us-mmwr201504. Accessed 16 May 2016
  3. 3.
    Amos, B., Turner, H., White, J.: Applying machine learning classifiers to dynamic android malware detection at scale. In: Proceedings of the 9th International Wireless Communications and Mobile Computing Conference (IWCMC 2013), pp. 1666–1671. IEEE (2013)Google Scholar
  4. 4.
    Christodorescu, M., Jha, S.: Static analysis of executables to detect malicious patterns. In: Proceedings of the 12th Conference on USENIX Security Symposium, vol. 12, p. 12. USENIX Association (2003)Google Scholar
  5. 5.
    Demertzis, K., Iliadis, L.: SAME: an intelligent anti-malware extension for android ART virtual machine. In: Núñez, M., Nguyen, N.T., Camacho, D., Trawiński, B. (eds.) Computational Collective Intelligence. LNCS. Springer, Switzerland (2015)Google Scholar
  6. 6.
    Demertzis, K., Iliadis, L.: Bio-inspired hybrid intelligent method for detecting android malware. In: Kunifuji, S., Papadopoulos, A.G., Skulimowski, M.A., Kacprzyk, J. (eds.) Knowledge, Information and Creativity Support Systems: Selected Papers from KICSS 2014, pp. 289–304. Springer, Switzerland (2016)CrossRefGoogle Scholar
  7. 7.
    Egele, M., Scholte, T., Kirda, E., Kruegel, C.: A survey on automated dynamic malware-analysis techniques and tools. ACM Comput. Surv. 44(2), 6:1–6:42 (2012). http://doi.acm.org/10.1145/2089125.2089126 CrossRefGoogle Scholar
  8. 8.
    Jacob, G., Debar, H., Filiol, E.: Behavioral detection of malware: from a survey towards an established taxonomy. J. Comput. Virol. 4(3), 251–266 (2008)CrossRefGoogle Scholar
  9. 9.
    Griffin, K., Schneider, S., Hu, X., Chiueh, T.: Automatic generation of string signatures for malware detection. In: Kirda, E., Jha, S., Balzarotti, D. (eds.) RAID 2009. LNCS, vol. 5758, pp. 101–120. Springer, Heidelberg (2009)CrossRefGoogle Scholar
  10. 10.
    Hall, M., Frank, E., Holmes, G., Pfahringer, B., Reutemann, P., Witten, I.H.: The weka data mining software: an update. SIGKDD Explor. Newsl. 11(1), 10–18 (2009). http://doi.acm.org/10.1145/1656274.1656278 CrossRefGoogle Scholar
  11. 11.
    Joshua, A., Waziri, O.V., Abdullahi, M.B., Arthur, U.M., Adewale, O.S.: A machine learning approach to anomaly-based detection on android platforms. Int. J. Netw. Secur. Appl. 7(6), 15–35 (2015)Google Scholar
  12. 12.
    Menahem, E., Shabtai, A., Rokach, L., Elovici, Y.: Improving malware detection by applying multi-inducer ensemble. Comput. Stat. Data Anal. 53(4), 1483–1494 (2009)MathSciNetCrossRefMATHGoogle Scholar
  13. 13.
    Moser, A., Kruegel, C., Kirda, E.: Limits of static analysis for malware detection. In: Proceedings of the 23rd Annual Computer Security Applications Conference, pp. 421–430. IEEE (2007)Google Scholar
  14. 14.
    Moskovitch, R., Elovici, Y., Rokach, L.: Detection of unknown computer worms based on behavioral classification of the host. Comput. Stat. Data Anal. 52(9), 4544–4566 (2008)MathSciNetCrossRefMATHGoogle Scholar
  15. 15.
    Nouretdinov, I., Vovk, V., Vyugin, M.V., Gammerman, A.J.: Pattern recognition and density estimation under the general i.i.d. assumption. In: Helmbold, D.P., Williamson, B. (eds.) COLT 2001 and EuroCOLT 2001. LNCS (LNAI), vol. 2111, pp. 337–353. Springer, Heidelberg (2001)CrossRefGoogle Scholar
  16. 16.
    Papadopoulos, H.: Inductive conformal prediction: theory and application to neural networks. In: Fritzsche, P. (ed.) Tools in Artificial Intelligence, Chap. 18, pp. 315–330. InTech, Vienna, Austria (2008). http://www.intechopen.com/download/pdf/pdfs_id/5294
  17. 17.
    Papadopoulos, H., Proedrou, K., Vovk, V., Gammerman, A.J.: Inductive confidence machines for regression. In: Elomaa, T., Mannila, H., Toivonen, H. (eds.) ECML 2002. LNCS (LNAI), vol. 2430, pp. 345–356. Springer, Heidelberg (2002)CrossRefGoogle Scholar
  18. 18.
    Rieck, K., Holz, T., Willems, C., Düssel, P., Laskov, P.: Learning and classification of malware behavior. In: Zamboni, D. (ed.) DIMVA 2008. LNCS, vol. 5137, pp. 108–125. Springer, Heidelberg (2008)Google Scholar
  19. 19.
    Sahs, J., Khan, L.: A machine learning approach to android malware detection. In: Proceedings of the 2012 European Intelligence and Security Informatics Conference (EISIC), pp. 141–147. IEEE (2012)Google Scholar
  20. 20.
    Shabtai, A., Moskovitch, R., Elovici, Y., Glezer, C.: Detection of malicious code by applying machine learning classifiers on static features: a state-of-the-art survey. Inf. Secur. Tech. Rep. 14(1), 16–29 (2009)CrossRefGoogle Scholar
  21. 21.
    Vovk, V., Gammerman, A., Shafer, G.: Algorithmic Learning in a Random World. Springer, New York (2005)MATHGoogle Scholar

Copyright information

© IFIP International Federation for Information Processing 2016

Authors and Affiliations

  • Nestoras Georgiou
    • 1
  • Andreas Konstantinidis
    • 1
  • Harris Papadopoulos
    • 1
  1. 1.Department of Computer Science and EngineeringFrederick UniversityNicosiaCyprus

Personalised recommendations