M0Droid : an android behavioral-based malware detection model

Damshenas, M; Dehghantanha, A; Choo, KR; Mahmud, R

Abstract

Anti-mobile malware has attracted the attention of the research and security community in recent
years due to the increasing threat of mobile malware and the significant increase in the number of
mobile devices. M0Droid, a novel Android behavioral-based malware detection technique comprising
a lightweight client agent and a server analyzer, is proposed here. The server analyzer generates a signature for every application (app) based on the system call requests of the app (termed app behavior)
and normalizes the generated signature to improve accuracy. The analyzer then uses Spearman’s rank
correlation coefficient to identify malware with similar behavior signatures in a previously generated
blacklist of malwares signatures. The main contribution of this research is the proposed method to
generate standardized mobile malware signatures based on their behavior and a method for comparing
generated signatures. Preliminary experiments running M0Droid against Genome dataset and APK submissions of Android client agent or developers indicate a detection rate of 60.16% with 39.43%
false-positives and 0.4% false-negatives at a threshold value of 0.90. Increasing or decreasing the
threshold value can adjust the strictness of M0Droid. As the threshold value increases, the false-negative rate will also increase, and as the threshold value decreases, the detection and false-positive
rates will also decrease. The authors hope that this research will contribute towards Android malware
detection techniques.

Citation

Damshenas, M., Dehghantanha, A., Choo, K., & Mahmud, R. (2015). M0Droid : an android behavioral-based malware detection model. Journal of information privacy & security, 11(3), 141-157. https://doi.org/10.1080/15536548.2015.1073510

• Journal Article Type: Article
• Publication Date: Sep 23, 2015
• Deposit Date: Oct 1, 2015
• Journal: Journal of Information Privacy and Security
• Print ISSN: 1553-6548
• Electronic ISSN: 2333-696X
• Peer Reviewed: Peer Reviewed
• Volume: 11
• Issue: 3
• Pages: 141-157
• DOI: https://doi.org/10.1080/15536548.2015.1073510
• Publisher URL: http://dx.doi.org/10.1080/15536548.2015.1073510
• Related Public URLs: http://www.tandfonline.com/loi/uips20#.Vg0NyKhdUuc
• Additional Information: Funders : 625402- FP7-PEOPLE;Research University Grant Scheme (RUGS)–University Putra; Projects : Project 9371600 (0502122147RU)